Weave Code
Hcaptcha Bundle Laravel Package
meteo-concept/hcaptcha-bundle
Symfony bundle that adds hCaptcha protection to your forms with minimal setup. Includes a dedicated form type and server-side validation to block bots and spam, with simple configuration for Symfony applications.
Meteo Concept hCaptcha Bundle brings hCaptcha spam protection to Symfony applications. It provides a reusable form type and validator for server-side verification, letting you add hCaptcha to forms with minimal configuration and reject missing or invalid tokens.
- Ready-to-use Symfony form integration
- Built-in server-side validation
- Configurable site and secret keys
- Clear handling of verification failures
- Lightweight setup through bundle configuration
Frequently asked questions about Hcaptcha Bundle
- Can I install meteo-concept/hcaptcha-bundle in a Laravel application?
- No. The package is a Symfony bundle that depends on FrameworkBundle, Symfony's DependencyInjection container, HttpKernel, Config and Form components, none of which exist in Laravel. Composer may resolve it, but its services are never booted, so you get no form type, no Twig widget and no validation integration. Port the verification behavior into a Laravel service provider and validation rule instead.
- Is meteo-concept/hcaptcha-bundle a Laravel package or a Symfony bundle?
- It is a Symfony 4+ bundle, not a Laravel package. Its architecture is built around Symfony service definitions, form type extensions and event subscribers. The only genuinely portable piece is the server-side siteverify HTTPS call, which is small enough to reimplement natively in Laravel in about a day.
- How do I add hCaptcha to a Laravel form without a Symfony bundle?
- Build a small internal package: an HCaptchaService that posts to api.hcaptcha.com/siteverify, a validation rule wrapping that service, a Blade component that renders the widget script and hidden response field, and a publishable config/hcaptcha.php for site key and secret. Read the keys from environment variables or a secret manager rather than committing them. Expose the raw verification result so callers can log error codes and score values.
- How do I verify an hCaptcha token server-side in Laravel?
- Send an HTTPS POST to https://api.hcaptcha.com/siteverify with your secret, the user's response token, the sitekey and optionally the remoteip. Inspect the JSON success boolean and, if present, the hostname and error-codes array before accepting the submission. Use Laravel's Http facade or Guzzle, set a short timeout, and treat each token as strictly single-use.
- What license does meteo-concept/hcaptcha-bundle use?
- The repository reports NOASSERTION, meaning there is no clear OSI-approved license declared. That is a real legal exposure if you copy code or ship it as a dependency, and it will surface in any dependency audit. Confirm the actual license with the maintainer before any code reuse, and write your own implementation if the answer is unclear.
- Which hCaptcha modes does the bundle support, such as invisible, checkbox or Enterprise?
- The documentation describes a standard form type with server-side validation, which maps to the checkbox and passive widget flows; Enterprise score thresholds, rqdata and custom difficulty are not clearly documented. Audit the verification request to confirm whether sitekey and remoteip are actually sent and whether hostname and credit are validated or discarded. If you need Enterprise scoring, plan to implement it yourself.
- How should I handle hCaptcha error codes like timeout-or-duplicate in Laravel?
- hCaptcha returns error-codes such as missing-input-response, invalid-input-response, invalid-input-secret, invalid-input-request and timeout-or-duplicate. Treat any non-success result as a validation failure for the current submission, but log the specific code so you can distinguish user mistakes from misconfiguration. timeout-or-duplicate usually means a replayed or expired token, so never cache or reuse a token after a successful check.
- Should hCaptcha verification fail open or fail closed when the API is unreachable?
- For signup, login and checkout, fail closed by default so a network outage cannot silently disable bot protection. Make the policy configurable and pair it with a short HTTP timeout so a slow hCaptcha API does not stall your request cycle. Log fail-closed events with enough context to tell an outage apart from an attack.
- Which HTTP client should I use for hCaptcha verification in Laravel, Guzzle or symfony/http-client?
- Use Laravel's Http facade, which is Guzzle-backed and already installed, rather than adding symfony/http-client as the Symfony bundle does. Response handling and timeout semantics differ between the two, so assert on them explicitly when porting. A single outbound POST needs no extra dependency.
- Is meteo-concept/hcaptcha-bundle actively maintained, and what are the alternatives?
- Community signal is thin: roughly 23 stars, zero dependents and single-vendor maintenance by Meteo-Concept, so assume no upstream support. Practical alternatives are hCaptcha's official documentation plus a small Laravel-native implementation, or a purpose-built Laravel hCaptcha package. Either way, plan to own the code and cover it with your own tests.
Weaver
How can I help you explore Laravel packages today?