- What is marcogermani87/filament-captcha and how does it work in Filament forms?
- It is a Laravel package that adds a captcha image field to Filament forms. It ships as a native Filament panel plugin plus a custom CaptchaField::make('captcha') component, so the challenge runs inside Filament's normal schema and validation lifecycle. Image generation and verification are delegated to Gregwar/Captcha, which renders distorted text with GD and keeps the expected answer in the session. The package adds no database tables, no queue, and no external API calls.
- How do I install filament-captcha in a Laravel application?
- Run composer require marcogermani87/filament-captcha, then optionally publish the config with php artisan vendor:publish --tag="filament-captcha-config". Register the plugin with one ->plugin() call in your panel provider and add CaptchaField::make('captcha') to each form you want to protect. For a developer who already knows Filament the code change takes under an hour; budget about half a day including QA, translation review, and an accessibility check. No panel-wide hooks are registered, so conflicts with other Filament plugins are unlikely.
- Which Filament, Laravel, and PHP versions does filament-captcha support?
- Pin ^2.x for Filament 4 or 5 on Laravel 11, 12, or 13 with PHP 8.2 through 8.5. Pin ^1.x for Filament 3, which covers Laravel 10 through 13 on PHP 8.x, requiring 8.2+ on the newer Laravel lines. Laravel 9, PHP 8.1, and Filament 2 are out of scope, so do not install and hope. Both branches have received feature work, but the 1.x line is a second maintenance stream you have to track.
- How do I configure captcha length, charset, image size, and the refresh button?
- Publish the config file and you can set length (default 5), charset (defaults to a mixed alphanumeric set), width (180), height (50), and background_color as an RGB array. The refresh button is configurable too, including its Heroicon such as heroicon-o-arrow-path. Every value has a sensible default, so a minimal install needs no config at all. Change charset and length only after checking readability at your rendered image size.
- Which forms can this captcha actually protect in a Filament panel?
- The package protects Filament forms only, so on a typical admin panel it guards a surface that is already gated behind authentication. The real value case is public-facing Filament forms, registration or onboarding panels, and Filament-powered front-ends that anonymous users can reach. Confirm those forms exist before committing; if every form sits behind a login, the security benefit is close to zero. It also will not cover non-Filament routes such as standard Laravel auth controllers.
- Does filament-captcha require GD and sessions, and does it work behind a load balancer?
- It needs the GD PHP extension for image generation and a working session store for the challenge. File-backed sessions break behind a load balancer because the challenge is written on one node and verified on another, so use a shared store such as Redis or DynamoDB. Both GD and sessions are usually present, but both fail loudly in production when missing. Verify them in staging with the same session driver you use in production.
- Is an image captcha accessible, and what about WCAG or the European Accessibility Act?
- The field renders an image challenge and the documentation describes no audio or alternative challenge path, which is a WCAG 2.1 AA success criterion 1.1.1 concern. For EU-facing products it is also a European Accessibility Act exposure. This is a policy decision rather than a code fix: decide whether you take a documented exception, offer an alternative contact channel, or drop the package. Record the decision before rollout.
- How strong is filament-captcha compared with reCAPTCHA or hCaptcha?
- Gregwar/Captcha produces distorted text images, which stop naive bots and casual spam but not determined actors using commodity OCR. Treat it as deterrence only, never as a control for credential stuffing, fraud, or regulated transaction approval. Its advantage over reCAPTCHA or hCaptcha is privacy and procurement: no vendor JavaScript, no external API call, no third-party data processor, and therefore no DPA or cookie-consent implications. That buys compliance simplicity at the cost of bot-defense strength.
- Why does the README example import MarcoGermani87\FilamentCookieConsent\Components\CaptchaField?
- That import is a copy-paste error from a sibling package and points at the wrong namespace. Use the CaptchaField class that ships with this package, and flag the correct path in your integration ticket so nobody loses an hour debugging it. The mistake also signals thin documentation QA, which is a reasonable proxy for overall release rigor. Check the vendor directory if you want the authoritative namespace before writing the form.
- Is filament-captcha actively maintained, and what happens if the maintainer stops?
- Adoption is thin: roughly 19 GitHub stars, no dependents on Packagist, and a single maintainer, so there is no ecosystem evidence of production use at scale. Treat it as vendored code with an internal owner rather than a supported dependency. The MIT license and small, forkable codebase keep the exit cheap, but agree a maximum acceptable lag behind a Filament major before you commit. Re-run a short review each time you upgrade Filament.