Symfony Altcha Bundle Laravel Package

Product Decisions This Supports

• CAPTCHA / bot-mitigation strategy: supports a build-vs-buy call to replace reCAPTCHA/hCaptcha with a self-hosted, proof-of-work challenge. ALTCHA requires no third-party script, no user tracking, and no vendor account — a meaningful differentiator for privacy-positioned products and EU traffic.
• Compliance and legal review: removes a third-party data processor from the signup/login funnel (no Google DPA, no cookie-consent surface for the widget). Useful ammunition when legal or DPO pushes back on the current CAPTCHA vendor.
• Abuse-resistance roadmap: release 1.0.5 adds IP rate limiting on the challenge endpoint and display mode support. The rate limiter closes the most common objection to self-hosting (endpoint farming / challenge-flooding abuse) without standing up a separate WAF or Redis-backed limiter for an MVP. Display modes (inline, floating, bar) give design control over where the challenge appears in signup, login, checkout, and password-reset flows.
• Conversion experimentation: because the widget is self-hosted and configurable, PMs can A/B challenge placement, difficulty, and display mode without a vendor contract or per-request cost. Invisible/floating placements are the usual candidates for reducing signup friction.
• Cost modelling: per-request pricing disappears; the cost shifts to your own infrastructure and engineering time. Worth quantifying at projected auth volume before committing.
• Maintenance/roadmap signal: Renovate automation being added indicates the maintainer is setting up dependency hygiene — a mild positive on sustainability, not a substitute for a support plan.

When to Consider This Package

Adopt when:

• The application is a Symfony app (this is druidfi/symfony-altcha-bundle, not a Laravel package — Laravel teams would need the underlying ALTCHA JS widget plus a custom challenge controller, and should budget for that).
• Privacy, GDPR posture, or "no third-party trackers" is a stated product or marketing position.
• You want a self-hosted, low-cost gate on signup, login, password reset, or contact forms — and your abuse profile is opportunistic bots and scripted spam rather than targeted fraud.
• Your team is comfortable owning a challenge endpoint (rate limits, key rotation, HMAC secret management) as part of normal app operations.
• You want to pilot quickly: 1.0.5's built-in IP rate limiting means you can ship an MVP without procuring additional bot-mitigation infrastructure.

Look elsewhere when:

• You need managed risk scoring, device fingerprinting, or adaptive challenges for credential stuffing and account-takeover fraud — that is bot-management territory (Cloudflare Turnstile/Bot Management, hCaptcha Enterprise, DataDome), not a PoW widget.
• You are not on Symfony and do not want to own the integration glue.
• You require a vendor SLA, named support, or a security review package — this is a single-maintainer open-source bundle on a 1.0.x line.
• Your users skew toward locked-down or low-power devices, or JS-disabled contexts, where PoW timing and accessibility need explicit testing before it becomes a conversion gate.
• You need a mature admin console, analytics on challenge pass rates, or fraud reporting out of the box.

How to Pitch It (Stakeholders)

For executives: We can replace our paid, third-party CAPTCHA with a self-hosted, privacy-preserving alternative that removes a data processor from our signup and login flows and eliminates per-request fees. The latest release (1.0.5) adds two things that previously blocked us: built-in IP rate limiting on the challenge endpoint — so the widget cannot be trivially abused to flood our servers — and configurable display modes, so design can place the challenge where it costs us the least conversion. Net effect: lower run-rate cost, a stronger privacy story for legal and marketing, and no vendor dependency. The trade-off is that we operate the endpoint ourselves and depend on a small open-source project.

For engineering: Note this is a Symfony bundle, not a Laravel package — if our target service is Laravel, scope the work as "integrate the ALTCHA widget and implement /altcha/challenge ourselves," not "install the bundle." 1.0.5 is additive: IP rate limiting on the challenge endpoint plus display-mode support, with no breaking changes and no migration work beyond a minor version bump. Dependency automation (Renovate) has been added, which helps on the maintenance side.

Recommended next step: time-boxed pilot on one low-risk surface (contact form or password reset) to measure challenge pass rate, latency on low-end mobile, and signup conversion versus the current CAPTCHA. Treat single-maintainer risk and endpoint operations as the two items to accept explicitly before expanding to login or checkout.