Filament Turnstile Laravel Package

Product Decisions This Supports

• Whether to put a bot barrier in front of public-facing forms. Filament panels typically expose login, registration, password reset, and contact/newsletter forms — all classic spam and credential-stuffing targets. This package makes "add a CAPTCHA to those forms" a config-level decision rather than a sprint of custom work, so it belongs in the abuse-prevention discussion alongside rate limiting and email verification.
• CAPTCHA vendor selection (build vs. buy vs. which provider). Cloudflare Turnstile is a genuine alternative to reCAPTCHA and hCaptcha; the choice has privacy, UX, and procurement consequences, not just technical ones (see below).
• Privacy/compliance posture. Turnstile is designed to avoid the cookie-and-tracking profile that makes reCAPTCHA a recurring GDPR/DPA review item in the EU. If your legal or security team has flagged reCAPTCHA, this package is the cheapest path to removing that flag on Filament surfaces.
• Scope of a hardening roadmap item. "Reduce spam signups / block credential stuffing on the admin panel" can be scoped as a small, reversible change (env keys + a form component) rather than an epic. Useful when negotiating priority against other security work.
• Dependency and maintenance risk on a security-adjacent surface. The v1.0.0 → v1.2.0 jump arrived with release notes that are nothing but a changelog URL — no feature list, no breaking-change callout. That is a legitimate input to the build-vs-buy call: a thin-maintenance, single-maintainer package sitting in your auth path is a risk you should consciously accept or mitigate (pin the version, read the diff before upgrading).
• Build vs. buy for the integration itself. Turnstile's own API is small; the value here is the Filament form-component wiring and theming, not the protocol. If you only need Turnstile on one non-Filament form, the package buys you little.

When to Consider This Package

Adopt it when most of these are true:

• You are already running Filament and the forms you want to protect are Filament forms (login, registration, contact, custom panel forms). This is the package's entire reason to exist.
• You have measurable abuse — spam accounts, fake signups, credential-stuffing attempts in logs — or a compliance requirement pushing you off reCAPTCHA.
• You are comfortable with a Cloudflare dependency for an auth-path control, including the failure mode where Cloudflare is unreachable and you must decide (in config) whether to fail open or closed.
• Your team is small enough that buying a ~one-file integration beats owning it, and you can absorb the maintenance risk with version pinning plus a diff review on upgrade.
• You have verified Filament version compatibility against the release you plan to install — the version history here is sparse, and v1.2.0's notes do not state supported Filament majors. Check composer.json and the actual diff, not the release notes.

Look elsewhere when:

• You are not on Filament. Use a framework-level Turnstile package (e.g. ryangjchandler/laravel-turnstile or Cloudflare's own server-side validation docs) instead — this package's Filament coupling is dead weight otherwise.
• You need protection on API endpoints, mobile clients, or non-form flows. Turnstile widgets are form-oriented; you want a token-verification service plus rate limiting.
• You need enterprise bot management, risk scoring, or managed rules — that is Cloudflare's paid Bot Management product, not this widget.
• You require maintenance guarantees (multiple maintainers, security policy, regular release cadence with readable notes). The bare-changelog release and single-vendor ownership are disqualifying if this sits in your auth path under a strict vendor-risk policy.
• You need accessibility guarantees baked in. Turnstile has improved here, but you should test your actual widget modes rather than assume; the package does not add anything on top.

How to Pitch It (Stakeholders)

To executives: "There's a small, free Laravel plugin that adds Cloudflare's CAPTCHA to our admin panel's login and signup forms. It reduces spam accounts and automated login attempts, and unlike Google's reCAPTCHA it doesn't use tracking cookies, which removes a recurring privacy review item for our EU traffic. Cost is an afternoon of engineering plus a free Cloudflare account; the change is reversible by flipping a config flag. The trade-off: it's a small third-party package in a sensitive spot, so we'll pin the version and review the code before each upgrade."

To engineering: "Filament-native Turnstile component. Keys go in env, no migrations, no schema changes. Two things to settle before we merge: (1) fail-open vs. fail-closed when the Turnstile verify call errors, and (2) which forms get it — login and registration at minimum, contact forms if we have them. Before upgrading to v1.2.0, read the actual diff against v1.0.0 rather than the release notes — they're a changelog link only, and we should confirm the supported Filament majors and that nothing in the verify flow changed. Pin the version in composer.json and treat it as a security-adjacent dependency."