Filament Turnstile Laravel Package

Product Decisions This Supports

• Security Enhancement: Integrate Cloudflare Turnstile CAPTCHA into Filament admin panels to mitigate bot attacks (e.g., fake user registrations, form spam) with minimal engineering effort. Aligns with security-first roadmaps for SaaS products or internal tools.
• Compliance & UX: Replace legacy CAPTCHAs (e.g., reCAPTCHA) with a GDPR-compliant, user-friendly alternative, reducing friction in high-value flows (e.g., login, support forms).
• Developer Efficiency: Accelerate feature delivery by leveraging a pre-built, Filament-native solution (vs. custom Laravel/JS integration), reducing technical debt. Ideal for PMs managing tight timelines.
• Roadmap Prioritization: Justify investment in admin panel security by demonstrating low-risk adoption (MIT license, active maintenance, 80+ downloads/month).
• Multi-Tenant SaaS: Standardize CAPTCHA across tenant-specific Filament panels without per-tenant configuration overhead.
• Cost Optimization: Avoid Cloudflare Turnstile’s per-request pricing pitfalls by implementing client-side validation (via the package’s reset events) to minimize API calls.

When to Consider This Package

• Adopt if:

  • Your primary use case is Filament admin panels (not standalone Laravel apps) and you need Turnstile CAPTCHA.
  • You prioritize speed of implementation over granular customization (e.g., custom themes, event hooks).
  • Your team uses Filament v3+ and PHP 8.1+ (package dependencies).
  • You’re already using Cloudflare Turnstile (or evaluating it) and want seamless Filament integration.
  • You need automatic CAPTCHA reset on form validation errors (built-in via onValidationError).
  • Your bot abuse is concentrated in Filament forms (e.g., user creation, feedback) rather than frontend routes.

• Look elsewhere if:

  • You require server-side CAPTCHA scoring (Turnstile’s client-side validation may not suffice).
  • Your project needs deep customization (e.g., dynamic Turnstile themes per user role, non-standard event names).
  • You’re using Filament v2 or an older Laravel version (compatibility risks).
  • You need multi-language support beyond Turnstile’s official locales.
  • Your primary CAPTCHA use case is outside Filament (e.g., frontend routes, APIs).
  • You prefer open-source alternatives with broader adoption (e.g., hCaptcha, reCAPTCHA v3).

How to Pitch It (Stakeholders)

For Executives:

"This package lets us add Cloudflare Turnstile CAPTCHA to our Filament admin panels in 15 minutes—blocking bot abuse on user creation, feedback forms, and logins without hiring dev resources. It’s a drop-in security upgrade with no ongoing maintenance, aligning with our GDPR compliance goals and reducing support costs from fake accounts. The MIT license and active updates make it a low-risk bet."

Key Outcomes:

• ✅ Faster security rollouts (vs. custom dev work).
• ✅ Lower bot-related costs (e.g., fake user cleanup).
• ✅ Compliance-ready (Turnstile is GDPR-friendly).
• ✅ Scalable (works across all Filament panels).

For Engineering:

*"This is a Filament-specific wrapper for Cloudflare Turnstile that handles:

• Form integration (1 line of code: Turnstile::make('captcha')).
• Auto-reset on errors (via onValidationError hook).
• Config management (.env keys, custom event names).
• Blade/JS compatibility (fixed in v1.0.7).

Why use it?

• No frontend/JS work: Uses Turnstile’s client-side library under the hood.
• Filament-native: Extends Filament’s form system (not a generic Laravel package).
• Lightweight: ~500 LOC, no bloat.
• Future-proof: Supports Turnstile’s latest features (e.g., size, theme enums).

Trade-offs:

• Limited to Filament forms (not APIs/standalone pages).
• Relies on Turnstile’s client-side validation (server-side scoring requires custom logic).

Recommendation: Adopt for admin panel security—it’s the fastest way to add Turnstile without reinventing the wheel."*