Recaptcha Laravel Package

Product Decisions This Supports

Bot & abuse mitigation on public surfaces. The core product question this package answers is "how cheaply can we put a CAPTCHA gate in front of X?" The decisions it informs:

• Where to place friction. Signup, login, password reset, contact/lead forms, guest checkout, review submission, coupon redemption, API key creation. Each placement is a conversion-vs-abuse tradeoff, and a thin siteverify wrapper is the lowest-effort way to test that tradeoff.
• Build vs. buy (and it's really "buy vs. one function"). The package is a ~50-line wrapper around Google's siteverify endpoint: a Guzzle client, a secret/config lookup, and a boolean/array response. The genuine build cost is a few hours, not a sprint. Treat this as a build decision you're outsourcing, not a strategic dependency.
• Vendor selection inside the CAPTCHA category. reCAPTCHA v2 (checkbox/invisible), reCAPTCHA v3 (score-based, no user interaction), hCaptcha, Cloudflare Turnstile. A wrapper like this one locks you to the v2 verification shape, which is a product-level constraint: v3 requires threshold tuning and score logging, not a pass/fail rule.
• Privacy & compliance posture. reCAPTCHA sends user signals to Google. For EU/UK traffic, or if you have DPA/data-residency commitments, this is a decision point that no PHP wrapper can resolve — a Turnstile or self-hosted alternative may be the actual answer.
• Roadmap sequencing. "Ship abuse protection this quarter" vs. "defer to a platform/edge-layer solution." This package supports the former only.

When to Consider This Package

Consider it when all of the following hold:

• You have a legacy Laravel or plain-PHP app already pinned to older Guzzle/PHP versions and you need a minimal, dependency-light siteverify call.
• You only need reCAPTCHA v2 (checkbox or invisible), with a simple pass/fail gate and no score thresholds.
• The code path is non-critical: a marketing contact form, a low-value newsletter signup. Not login, not payments, not account recovery.
• You're doing a throwaway spike to measure bot volume before committing to a real solution.

Look elsewhere — or write the ~40 lines yourself — when:

• Maintenance status matters. Last release 2017-07-11, 16 stars, 0 dependents. That is an abandoned dependency on a security-adjacent path. No PHP 8 / Guzzle 7 guarantees, no v3, no Enterprise, no maintenance window if Google changes the response contract.
• You need v3 score handling, action/domain validation, or Enterprise — the response shape and decision logic are meaningfully different.
• You're on modern PHP/Laravel; use a maintained alternative (e.g., an actively released Laravel reCAPTCHA package), Cloudflare Turnstile, or a direct Http::post() call.
• You need accessibility commitments (audio/alternative challenges), mobile SDK support, or SLA-backed vendor support.
• Your security review requires tracked, patched dependencies in the supply chain.

Net PM recommendation: do not adopt for new work. If it's already in the codebase, scope a migration ticket; the wrapper is small enough that replacement is a low-risk, sub-day change — the risk is entirely in staying.

How to Pitch It (Stakeholders)

To executives: "This is a tiny, free (MIT) helper library that lets our app ask Google 'was this really a human?' before accepting a form submission. It costs nothing and takes hours to integrate. The catch: it hasn't been updated since 2017, so it's effectively unmaintained. My recommendation is to not take the dependency — the same capability is roughly a day of engineering or a swap to a maintained vendor (Turnstile is free and lighter on user data). Either way, the strategic work isn't the library; it's deciding where to put friction and how much signup conversion we're willing to trade for spam reduction."

To engineering: "It's a Guzzle wrapper around siteverify plus config. No v3, no action/score validation, no maintenance since 2017, zero downstream dependents. I'd rather we own these 40 lines or adopt something with a release cadence. If we keep it, quarantine it to low-value forms and put it on the dependency-replacement backlog."

Decision framing to put in the doc: What we're really deciding is the CAPTCHA vendor and the friction budget — not the wrapper. Cost of the wrapper: ~0. Cost of the wrapper's abandonment: unbounded on a security path. Recommend a one-week spike comparing Turnstile vs. reCAPTCHA v3 on conversion, bot-block rate, and privacy review, then commit.