- Does fruitcakestudio/recaptcha support reCAPTCHA v3?
- No. The package's final release is dated 2017-07-11, before reCAPTCHA v3 launched in 2018, so it almost certainly supports only v2 checkbox or invisible flows. If your risk strategy requires v3 score-based validation, this package is disqualified and you should implement server-side siteverify calls with Laravel's Http client and a custom Rule.
- Is fruitcakestudio/recaptcha compatible with Laravel 9, 10, or 11?
- Compatibility is unverified and unlikely. The final release predates Laravel 5.5 auto-discovery and was not tested beyond roughly Laravel 5.4/5.5, so modern Laravel 9-11 support cannot be assumed. Before adopting it, spike the provider boot, config publish, rule registration, and Composer resolution against your target Laravel and Guzzle versions.
- How do I install fruitcakestudio/recaptcha in a Laravel app?
- Install with Composer, publish the package config, and add your site and secret keys to the environment. Because auto-discovery may be absent, you may need to register the service provider manually. The integration itself is small, but budget time to confirm it boots cleanly on your target Laravel major.
- How do I use the reCAPTCHA validation rule in a Laravel form request?
- Add the package's recaptcha rule to the Form Request or validator rules for the field that carries the reCAPTCHA token. The rule performs the server-side siteverify call using the configured secret key and returns validation errors when verification fails. Confirm the error message is translatable and that your fail-open or fail-closed policy is handled when Google is slow or unreachable.
- Does this package include middleware to protect routes from bots?
- The package description advertises middleware for protecting routes from bots, spam, and abuse, but its core value is the validation rule around Google's siteverify endpoint. Verify that any middleware surface exists and works on your Laravel version before relying on it. For API endpoints, you still need explicit server-side token verification in the request path.
- What is the best alternative to fruitcakestudio/recaptcha for Laravel?
- For most teams, the best alternative is a small in-house implementation: roughly 50-100 lines using Laravel's Http client to call Google's siteverify endpoint plus a custom validation Rule. That gives you v3 or Enterprise support, current Laravel compatibility, tests, and clear ownership. A maintained third-party package is also reasonable if it supports your required reCAPTCHA product.
- Is fruitcakestudio/recaptcha safe to use in production?
- It carries high lifecycle risk: it is abandoned, single-maintainer, last released in 2017, and has no security patch path for a security-adjacent control. The supply-chain surface is small and MIT-licensed, but unowned code in production is still a governance problem. Use it only if you fork and vendor it with an explicit owner, or replace it with maintained in-house code.
- How does fruitcakestudio/recaptcha verify reCAPTCHA tokens?
- It is a thin Laravel wrapper around Google's reCAPTCHA siteverify endpoint. The validation rule makes an outbound HTTP POST with the configured secret and user token, then treats Google's response as pass or fail. It is stateless and does not touch persistence, queues, or the broader request lifecycle beyond validation.
- Can I use this package with a decoupled SPA or mobile API?
- It is a poor fit for decoupled SPA or mobile architectures. The package assumes a Laravel monolith or server-rendered form layer and a single env-driven site/secret key pair, not per-tenant runtime keys or edge/API-gateway verification. For those cases, implement token verification in your API layer or gateway with a maintained or in-house solution.
- How should I test a Laravel reCAPTCHA integration?
- Spike it on the oldest and newest Laravel majors you support, confirming provider boot, config publish, rule registration, and a live end-to-end verification against Google. In automated tests, fake the outbound HTTP call so you can assert pass, fail, timeout, and fail-open versus fail-closed behavior without hitting Google. Also check Composer constraints for illuminate/support and guzzlehttp/guzzle before rollout.