- How do I install and configure mews/captcha in Laravel?
- Install it with composer require mews/captcha. Laravel auto-discovery registers the service provider and Captcha facade. Publish the config and bundled font assets with vendor:publish, then add the captcha image route with session and no-cache middleware. Render the image and hidden field in your Blade form and attach the captcha validation rule.
- Which Laravel and PHP versions does mews/captcha support?
- The package targets Laravel 5 and later, with Laravel 9 through 12 on PHP 8.1+ being the practical fit for current applications. Confirm the exact Composer constraint against your Laravel and PHP versions before adopting it. The host must have GD compiled with FreeType, and your deploy artifact must include the published font assets.
- How do I use the captcha validation rule in a Laravel form?
- Add 'captcha' => 'required|captcha' to your FormRequest rules or inline validator call. In the form, render the CAPTCHA image from the package route or helper and submit the matching hidden or text input named captcha. The package verifies the submitted value against the session-backed challenge. Keep the image route on session middleware and exclude it from page and CDN caching.
- How can I customize the mews/captcha image and fonts?
- Publish config/captcha.php and adjust settings such as length, width, height, colors, and font selection. Publish the package font directory and make sure those files are present in every deployed container or release artifact. Prefer GD over Imagick unless your host already ships Imagick. After changes, clear and cache config in production.
- Why is mews/captcha always failing validation in production?
- The most common causes are a session store that is not shared across all app instances, a cached CAPTCHA image response, or a session cookie that is not being sent consistently. Ensure the captcha route uses the same session middleware as your form and sends no-cache headers. Multi-region deployments and edge-cached pages can produce hard-to-reproduce failures. Verify Redis or database sessions are central and reachable from every node.
- Does mews/captcha work with Laravel APIs, SPAs, or stateless routes?
- No, it is designed for server-rendered forms in a session-bearing Laravel monolith. It depends on session state and an image route, so it is a poor fit for stateless APIs, SPA token flows, or CDN-cached edge pages without per-user routing. For those cases, evaluate Cloudflare Turnstile or hCaptcha instead. Keep any mews/captcha usage behind a wrapper if you may migrate later.
- Is mews/captcha accessible, and does it include an audio CAPTCHA?
- The package does not provide an audio alternative or equivalent accessible pathway out of the box. Public-facing forms in the EU, UK, and US can carry WCAG 2.1/2.2 AA and ADA exposure, so this is a product and legal decision, not just a library choice. Provide an alternative verification path or get explicit sign-off for a text-only challenge. Do not describe the package as a complete bot defense.
- How do I test Laravel forms that use mews/captcha?
- Wrap the package in a BotChallenge service or custom validation rule, then fake or bypass that wrapper in your test suite. Avoid trying to solve generated images in feature tests and avoid asserting on image bytes. Test that the CAPTCHA field is present, that validation fails without a valid challenge, and that your wrapper can be stubbed. This also keeps tests independent of GD and font assets.
- How do I refresh or regenerate the CAPTCHA image?
- Request the CAPTCHA image route again, typically with a cache-busting query string, to generate a new image and session value. Make sure the refresh request carries the same session cookie as the form submission. If you use a helper or Blade component, expose a small refresh control that updates the image source. Do not let a CDN or full-page cache serve the old image.
- Is mews/captcha enough for bot protection, or should I use Turnstile or hCaptcha?
- Treat mews/captcha as bot friction, not bot defense. Distorted-text image CAPTCHAs are broadly solvable by OCR and human-solver services, so pair them with WAF rules, rate limits, honeypots, and email verification. If accessibility, conversion, or modern threat coverage matter, evaluate Cloudflare Turnstile or hCaptcha. Measure your current abuse and conversion baselines before and after adoption so you can show whether the package helped or hurt.