- What does pawsitiwe/sulu-turnstile-bundle do?
- It is a Sulu CMS bundle that adds a Cloudflare Turnstile field to Sulu forms and validates submissions server-side. It is intended as a privacy-friendly, no-puzzle CAPTCHA alternative for reducing spam and automated form abuse. It is not described as a Laravel package in the supplied context.
- Does this package support Laravel?
- The package is presented as a Sulu CMS bundle, not a Laravel package, and the supplied context does not declare Laravel support. Laravel teams should verify framework fit before adopting it. If you need Turnstile in Laravel, evaluate a Laravel-specific integration instead.
- Which Laravel versions are supported?
- No Laravel version support is stated for this package because it targets Sulu CMS forms. The provided assessment also flags the absence of a supported PHP/Laravel matrix as a blocking question. Confirm Sulu, Symfony, and PHP compatibility from the repository before use.
- How do I install and configure it in a Sulu project?
- Install it with Composer and register or enable the bundle according to the project documentation. You then configure the Cloudflare Turnstile site key for rendering and the secret key for server-side verification. The supplied README excerpt does not include exact class names or config paths, so verify those in the repository.
- How does server-side Turnstile verification work?
- When a Sulu form is submitted, the Turnstile token is sent to the bundle, which verifies it with Cloudflare using your secret key. Invalid or missing tokens should cause the submission to be rejected. This keeps bot checks server-side rather than relying only on the browser widget.
- Where do I set the Turnstile site and secret keys?
- The package description says the keys are configurable through bundle configuration. The site key is used by the frontend Turnstile widget, while the secret key must stay server-side and out of version control. Check the repository for the exact configuration file and key names.
- Is it production-ready at v0.0.5?
- The supplied assessment treats v0.0.5 as pre-1.0 and notes that release notes were empty, so no stability guarantee should be assumed. Pin the exact version rather than using a broad constraint, and test in staging before production. Review the code and changelog status before relying on it.
- How can I test Turnstile forms without hitting Cloudflare?
- Use Cloudflare's documented Turnstile test keys in non-production environments and exercise both successful and failed verification paths. Also test missing tokens, expired tokens, and server-side rejection behavior. Confirm the package does not bypass verification when keys are absent.
- What are alternatives to this bundle for bot protection?
- Alternatives include integrating Cloudflare Turnstile directly, using hCaptcha or reCAPTCHA, or adding honeypot fields and rate limiting. For Laravel applications, look for Laravel-specific Turnstile or CAPTCHA packages. This bundle is specifically aimed at Sulu CMS forms.
- What maintenance concerns should I check before adopting it?
- Check the repository for license, maintainer activity, CI status, dependency constraints, and a changelog or release notes. The supplied assessment highlights empty v0.0.5 release notes and unknown change surface as risks. Pin the version, review the diff before upgrades, and avoid production adoption without resolving those gaps.