- How do I install mlk9/captcha-laravel?
- Run composer require mlk9/captcha-laravel, then publish the package config with php artisan vendor:publish and choose your driver. Laravel 6 and newer are the stated target. Because a new math driver shipped in a patch release, pin an exact version and read the changelog before upgrading in production.
- Which Laravel and PHP versions does this captcha package support?
- The package description targets Laravel 6 and newer, so Laravel 10, 11, and 12 are worth checking against the repo's composer.json. PHP version constraints are not confirmed in the provided context. Verify the CI matrix and composer.json before committing to it.
- How do I switch between image and math captcha drivers?
- Publish the config file and set the captcha driver to image or math. The package is described as config-driven, so switching challenge types should not require code changes. Confirm the exact config key and whether version 3.1.1 changed any driver names or validation signatures.
- How do I render and validate a captcha in a Laravel Blade form?
- Render the challenge with the package's Blade helper and validate the submitted answer with its Laravel validation rule, ideally inside a Form Request. Keep the challenge field name consistent between the view and the rule. Check the README for the exact helper and rule syntax.
- Is the math captcha secure enough against bots?
- A math CAPTCHA has a small answer space and is easy for bots and LLM-based solvers, so treat it as a friction control rather than strong anti-automation. Pair it with rate limiting, honeypots, and server-side abuse detection. Confirm whether attempts are capped server-side.
- Is this captcha accessible for screen-reader and cognitive-accessibility users?
- The provided context mentions no audio challenge or alternative path, and image-based math can be hard for screen-reader users. This is a WCAG 2.2 cognitive-function concern on public forms. Verify whether an audio option, alternative challenge, or bypass for authenticated users exists.
- Where is the captcha answer stored, and does it work behind a load balancer?
- Challenge state is likely stored in the Laravel session, which is the normal pattern for this type of package. Session expiry, multi-tab use, and back-button resubmission are predictable friction points. For multiple app instances behind a load balancer, use a shared session or cache driver and verify behavior.
- Can I create a custom captcha driver for this package?
- The addition of a math driver alongside image challenges implies a driver or strategy contract, but the exact interface is not documented in the provided context. Check the repository for a contract you can implement and register via config or the service provider. If no public contract exists, treat driver extensibility as unconfirmed.
- Does it work with Livewire, Inertia, or SPA and API forms?
- It fits Blade and Livewire forms well because the challenge can be rendered server-side. For Inertia or SPA forms, you need a Blade partial or JSON endpoint that exposes the challenge and validates the answer. It is a poor fit for pure token-based APIs; use it only on human-facing HTML endpoints.
- Does the package phone home to third-party services, and is it GDPR-friendly?
- The challenge appears self-contained, with no third-party CAPTCHA service mentioned, which is a privacy and GDPR advantage over reCAPTCHA. Confirm there is no phone-home behavior or external API call. Also check license, maintainer activity, and open-issue volume before adopting.