- Can I use gremo/captcha-form-bundle in a Laravel application?
- No. Despite being catalogued under Laravel/PHP, gremo/captcha-form-bundle is a Symfony bundle that depends on Symfony Kernel bootstrapping, DependencyInjection container extensions, the EventDispatcher and the symfony/form FormType extension points, none of which have an equivalent in Laravel's Blade, FormRequest and Validator stack. Installing it in a Laravel app pulls in redundant Symfony components and risks container or autoload conflicts, so the poor fit cannot be remedied by configuration. If you need CAPTCHA on contact, registration or login forms, implement it natively in Laravel instead.
- Is gremo/captcha-form-bundle still maintained?
- Effectively no. The package sits at 1 star with 0 dependents and a composite score of 0.035, which marks it as an unmaintained artifact. Expect pinned Symfony 2.x/3.x-era constraints and an old PHP floor that will not resolve against a modern Laravel composer.json without --ignore-platform-reqs hacks. With no maintainer responsiveness, any future security advisory would be unfixable in place.
- How do I install gremo/captcha-form-bundle?
- In Symfony it is installed with Composer, registered as a bundle in the kernel, and configured through the bundle's DependencyInjection extension. In a Laravel project a composer require is likely to fail dependency resolution or force downgrades of Illuminate packages, and there is no service provider or facade to register. The realistic option is to read the source as a reference implementation and re-implement the server-side verification yourself.
- How is the CAPTCHA configured in this bundle?
- Configuration follows the Symfony pattern: bundle registration in the kernel plus container-driven adapter selection through the bundle's extension, typically in YAML config. There is no publishable config file, no config/services.php entry and no .env-driven key management that Laravel developers expect. Provider credentials and adapter choice therefore cannot be wired into Laravel's configuration and config cache pipeline without custom code.
- Does this package support Laravel 10 or Laravel 11?
- No. The bundle targets Symfony 2.x/3.x-era applications and predates current Laravel releases entirely; it ships no service provider, no facade, no validation rule and no Blade components. There is no version of Laravel, including 10 or 11, that this package supports. Plan on a Laravel-native implementation rather than waiting for compatibility.
- What are the best Laravel alternatives to gremo/captcha-form-bundle?
- Maintained Laravel options include anhskohbo/no-captcha and RyanChandler/recaptcha, but modern providers are usually a better fit. Cloudflare Turnstile offers no user friction, a free tier and a simple siteverify API, and hCaptcha is a solid fallback when a vendor relationship requires it. Treat reCAPTCHA v2 only as a compatibility path, since it is increasingly bypassed.
- How do I add CAPTCHA validation to Laravel forms without this package?
- Create a rule class implementing Laravel's ValidationRule contract that performs a short-timeout server-side siteverify POST with the Http client, and add a Blade partial for the client widget. Define a CaptchaAdapter contract with a verify(string $token, ?string $ip): bool method and bind the chosen provider implementation in the container so providers stay swappable. That spike is roughly half a day and yields a cleaner result than any glue layer around the Symfony bundle.
- How do I test CAPTCHA validation in Laravel feature tests?
- Because the recommended rule goes through Laravel's Http client, you can call Http::fake() to stub the provider's siteverify response in feature tests. Alternatively bind a fake CaptchaAdapter implementation in the container so validation passes or fails deterministically without network calls. Either approach keeps the suite fast and avoids hitting real CAPTCHA endpoints.
- Is it safe to run an abandoned CAPTCHA package in production?
- It is high risk. CAPTCHA sits on an adversarial, anti-abuse boundary, so abandoned third-party code means no CVE response, no adapter updates and likely deprecated challenge providers, which gives false assurance rather than protection. The supply chain blast radius is low, since the package is MIT with few transitive dependencies, but zero maintainer responsiveness means any future advisory cannot be fixed in place. Build or adopt a maintained solution instead.
- Which CAPTCHA provider should I use: reCAPTCHA, hCaptcha or Cloudflare Turnstile?
- Default to Cloudflare Turnstile for its low friction, free tier and straightforward siteverify endpoint, and choose hCaptcha if a vendor or compliance relationship requires it. Use reCAPTCHA v2 only where existing contracts demand it, and note that reCAPTCHA v1 is dead. Before choosing, confirm whether the real requirement is a CAPTCHA at all or bot-driven spam reduction, since rate limiting plus a honeypot often solves the latter with less UX cost.