Weave Code
Turnstile Laravel Package
laragear/turnstile
Laragear Turnstile integrates Cloudflare's frictionless, privacy-friendly CAPTCHA into Laravel. It ships validation rules, middleware, Blade components, and helpers for seamless server-side verification, letting you protect forms from bots and spam without puzzles or user friction.
Use Cloudflare's no-CAPTCHA with HTTP/3 in your Laravel application.
Frequently asked questions about Turnstile
- What is laragear/turnstile and what does it do in Laravel?
- Laragear Turnstile is a Laravel package that wraps Cloudflare Turnstile, Cloudflare's frictionless and privacy-friendly CAPTCHA alternative. It provides server-side validation rules, middleware, Blade components, and helpers so Laravel apps can protect forms from bots without puzzles. It fits into Laravel's service provider, config, validation, and Blade ecosystems.
- How do I install and configure Laragear Turnstile in a Laravel application?
- Install it with Composer, then publish the package configuration and set your Cloudflare Turnstile site key and secret key for each environment. Add the Blade component or widget to your form and apply the package's validation rule on the server side. The package is designed to follow normal Laravel config and validation workflows.
- Which Laravel and PHP versions does laragear/turnstile support?
- The package is built for modern Laravel applications, but you should verify the exact Laravel and PHP constraints in its composer.json and README before installing. Version 2.1.1 is a patch release aimed at modern Laravel, Livewire 4, and Filament stacks. Always confirm compatibility against your application's locked dependency versions.
- Does laragear/turnstile work with Livewire 4 and Filament?
- Yes, the package includes a Filament widget, and v2.1.1 specifically fixes the Filament widget for Livewire 4 compatibility. That patch indicates active maintenance for modern Laravel and Livewire stacks. You should still test your specific Filament panel and Livewire component behavior after upgrading.
- How do I validate Cloudflare Turnstile server-side in Laravel?
- Use the package's Laravel validation rule on the request data submitted with your form. The rule performs the server-side verification call to Cloudflare and fails validation when the token is missing, invalid, or expired. This keeps bot protection tied into Laravel's normal validation and error-handling flow.
- What happens if Cloudflare Turnstile is unavailable or the keys are misconfigured?
- If Cloudflare Turnstile is unreachable or your site and secret keys are wrong, server-side validation can fail and block form submissions. The package does not remove the external dependency on Cloudflare, so outages or network restrictions are operational risks. Monitor validation failure rates and show clear user-facing error handling.
- Can I add a fallback or rate limiting if Turnstile validation fails?
- The package focuses on Turnstile integration rather than providing a built-in fallback strategy. For business-critical forms, implement application-level rate limiting, logging, and a documented fallback or manual review path if Cloudflare is unavailable. Test how your forms behave when validation cannot complete.
- What are the accessibility and privacy considerations of using Cloudflare Turnstile?
- Cloudflare Turnstile is designed to avoid traditional CAPTCHA puzzles and is described as privacy-friendly, but it still loads a third-party script and involves Cloudflare. Review Cloudflare's privacy and accessibility documentation for your compliance needs. Also account for content security policy, ad blockers, and users on restricted networks.
- How does laragear/turnstile compare with other Laravel CAPTCHA options, and is it maintained?
- It is a focused wrapper for Cloudflare Turnstile, so compare it with reCAPTCHA or hCaptcha packages plus Laravel's built-in rate limiting based on your privacy, UX, and vendor requirements. The v2.1.1 patch shows active maintenance for Livewire 4 and Filament compatibility. Assign an internal owner to watch Laravel, Livewire, and Filament upgrades.
- What should I test before upgrading to v2.1.1 or rolling out laragear/turnstile to production?
- Test successful validation, failed validation, expired tokens, missing keys, and Cloudflare-unavailable scenarios. If you use Filament or Livewire 4, verify the widget renders and submits correctly in your panels. Roll out to a low-risk form first and review any documented upgrade notes from v2.1.0 to v2.1.1.
Weaver
How can I help you explore Laravel packages today?