- Does greggilbert/recaptcha work with Laravel 8 or PHP 8?
- No. The package is explicitly marked abandoned, its last release was February 2016, and it targets Laravel 5-era framework and PHP constraints. Composer resolution will likely fail on PHP 8.x and Laravel 8+ because of stale Symfony, Guzzle, and Laravel contract requirements. Treat it as a legacy Laravel 5 artifact rather than a modern dependency.
- Is greggilbert/recaptcha abandoned?
- Yes. The repository description and package metadata label it as abandoned, and the last release was in February 2016. It receives no security patches, dependency updates, or compatibility fixes. Do not adopt it for new work, and plan to replace it if it is already in production.
- Which reCAPTCHA version does greggilbert/recaptcha support: v1, v2, or v3?
- The package predates modern reCAPTCHA v3 and may target the retired reCAPTCHA v1 endpoint that Google shut down in 2018. That means an existing integration may already be non-functional regardless of whether Composer installation succeeds. Before relying on it, confirm which endpoint the code actually calls and test it against Google's current siteverify API.
- How do I install greggilbert/recaptcha?
- Historically it was installed with Composer require greggilbert/recaptcha, followed by registering the service provider and editing the package config with your Google keys. On a modern stack installation will usually fail on PHP and Laravel version constraints. If you must install it, pin the exact PHP 5.6 or 7.x and Laravel 5.x matrix the package supports.
- How do I use the greggilbert/recaptcha validation rule in a Laravel form?
- The package registers a validation rule and Blade helpers so you can render a reCAPTCHA field and verify the response server-side. In Laravel 5 you would add the rule to your form request or validator rules array alongside the posted reCAPTCHA response field. Exact rule names and Blade directive syntax should be taken from the package README for your pinned version.
- How do I replace greggilbert/recaptcha in an existing Laravel application?
- Introduce an application-owned interface such as CaptchaVerifier, wrap the existing package calls behind it, and build a replacement using Http::post() to Google's siteverify endpoint or a maintained SDK. Run both behind a feature flag, compare outcomes, then remove the package, its config, and unused Google keys. This avoids a risky big-bang rewrite in a legacy codebase.
- Can I still use greggilbert/recaptcha in production?
- Only as contained legacy code on a pinned Laravel 5 and PHP 5.6 or 7.x runtime where it is already installed and verified working. It carries high risk from abandonment, unpatched security issues, dependency drift, and Google API deprecation. Define fail-open or fail-closed behavior explicitly and monitor verification success rate, latency, and quota errors.
- What are good alternatives to greggilbert/recaptcha for Laravel?
- For modern Laravel, use a maintained reCAPTCHA SDK or a thin custom validation rule around Http::post() to Google's siteverify endpoint. If the goal is simply bot mitigation, evaluate Cloudflare Turnstile, hCaptcha, or Laravel's native rate limiting before adding a CAPTCHA vendor. Native throttling is often sufficient for basic abuse prevention.
- What are the security risks of using this package?
- The main risks are abandonment, unpatched security issues, dependency drift, Google API deprecation, and unclear behavior against current reCAPTCHA endpoints. There is also compliance risk around sending user traffic to Google without a current data-processing review. Its low package score and opportunity score reinforce that it is a low-value, high-risk dependency.
- How do I test reCAPTCHA validation in Laravel without calling Google?
- Mock the verifier or the HTTP client in tests and assert that your validation rule handles both pass and fail responses correctly. If you wrap the package behind a CaptchaVerifier interface, you can bind a fake implementation in the container. Also test fail-open and fail-closed behavior so a production misconfiguration does not silently bypass spam protection.