- Is mulertech/captcha a Laravel package?
- No. Despite being listed alongside Laravel captcha options, the release notes describe a Symfony bundle targeting Symfony 6.4, 7.x and 8.x, with a Twig form theme, a CaptchaType form type, bundle auto-registration, and Symfony routing and translation. Laravel has no Symfony Form component, no Twig form themes and no bundle/DI auto-registration convention, so nothing in the integration layer transfers. Only the underlying captcha engine is even conceptually portable.
- Can I just run composer require mulertech/captcha in a Laravel 11 app?
- Installing it would pull in symfony/form, the Twig bridge and Symfony HttpFoundation session semantics, and you would still need a shim for bundle service and route registration. That produces an unsupported hybrid with a long tail of container and kernel assumptions. The bundle cannot be installed and used as delivered inside Laravel.
- What PHP version does mulertech/captcha require?
- PHP 8.4 or higher. That is a hard blocker independent of every other concern if your Laravel estate runs on 8.2 or 8.3, which many still do. Ask the maintainer whether the floor can be relaxed before you plan any integration work.
- Does mulertech/captcha need the GD extension?
- Yes. The challenge is rendered as a GD-generated JPEG, so ext-gd is mandatory. Several slim and Alpine container builds ship without it, which turns into a deployment-time surprise rather than a Composer-level one. Confirm your runtime image includes it before committing.
- How do I add a mulertech/captcha challenge to a Laravel Blade form?
- There is no Blade partial and no Laravel validation rule shipped, so you would write a clean-room adapter: a small CaptchaService for generation and verification, a custom validation rule, a Blade partial for the image and refresh control, and a refresh route. That port is more feasible than adopting the bundle and avoids most of the Symfony coupling. Expect roughly a one-to-two week spike including tests.
- Is an image math captcha strong enough to stop spam bots?
- Single-digit addition and subtraction with positive results gives roughly 20 possible answers, and the package documents no rate limiting or lockout on submission. Targeted guessing succeeds in a handful of requests regardless of how OCR-resistant the image is; the noise and line obfuscation defend against naive OCR, not a determined attacker or a cheap solver. Any Laravel port must add throttling and lockout in the host application.
- Is mulertech/captcha accessible to screen-reader users?
- The challenge is image-only with no audio or alternative challenge described, which is a WCAG and European Accessibility Act exposure and a frequent procurement blocker. If you port the engine, plan a non-visual fallback such as an audio challenge or an out-of-band verification path. Do not ship an image-only captcha on public-facing forms.
- Does mulertech/captcha work for API, token-authenticated or edge-cached forms?
- No. The design assumes a live session, storing the expected answer server-side with token issuance and TTL bookkeeping. API-first, token-authenticated and edge-cached form flows are not supported. Also confirm the refresh route distinguishes valid from expired tokens in its response, and that the session handling tolerates Redis, file and database drivers on multi-node deployments.
- Is mulertech/captcha production ready and actively maintained?
- Version 1.0.0 was published 2026-03-28, so there is no operating history to judge it by. There is no visible evidence of a security disclosure process, published test coverage, or clarity on license and maintainer bus factor. Treat it as unproven in production and get answers on those points first.
- What should Laravel developers use instead of mulertech/captcha?
- The lowest total cost option is not adopting it: use Laravel-native defences such as validation rules, honeypots and rate limiting, or a hosted challenge like reCAPTCHA, hCaptcha or Cloudflare Turnstile if you genuinely need one. Choose a self-hosted route only if there is a hard requirement for a no-third-party captcha, and then port just the arithmetic generator, GD renderer and token/TTL logic while owning the Laravel integration yourself.