- Is pwiejak/recaptcha-bundle a Laravel package?
- No. Despite how it is sometimes listed, this is a Symfony bundle and a hard fork of EWZRecaptchaBundle, built around Symfony's DependencyInjection, Form, Validator and Twig components. Laravel's form and validation layers are unrelated to Symfony's, so the bundle's value does not survive translation into a Laravel app. If your target is Laravel, treat this as out of scope and implement the siteverify call yourself.
- How do I install and configure pwiejak/recaptcha-bundle in a Symfony application?
- Install it with Composer, register the bundle in config/bundles.php, and add a YAML configuration block with your Google reCAPTCHA site key and secret key. You then render the provided form type or Twig helper in your templates and let the bundle's validator constraint handle server-side verification. Before doing any of this, inspect the fork's composer.json and last commit date, because no release history is published and Symfony 6/7 compatibility is unverified.
- Does pwiejak/recaptcha-bundle support reCAPTCHA v3 or Enterprise?
- Most likely not, or at least not verifiably. The upstream EWZRecaptchaBundle is v2 checkbox oriented, and a fork inherits its parent's feature set and its parent's abandonment timeline. There is no documented support for v3 score thresholds, action names, or token expiry handling, which is where most current product requirements live. Confirm this with the maintainer before you build a requirement around score-based verification.
- Which Symfony and PHP versions does pwiejak/recaptcha-bundle support?
- This is unknown from the repository metadata and must be verified first. Check the version constraints declared in composer.json, the date of the last commit, and whether the code tracks Symfony 6/7 deprecations and PHP 8.x typing. Because the fork carries no tagged releases or CHANGELOG, the only reliable test is booting it in a non-production Symfony app on your exact stack.
- How is pwiejak/recaptcha-bundle different from EWZRecaptchaBundle?
- It is described only as a fork, with no published delta. The practical questions to ask are why the fork exists, what was changed, and whether any of those changes are security-related. If the divergence is cosmetic or stale, the upstream bundle is the safer dependency simply because it has actual consumers and issue history.
- Is pwiejak/recaptcha-bundle safe to use in production?
- The risk profile is unusually high for the amount of functionality involved. The repository has zero stars, zero dependents, no cited release history, and a single maintainer, which means no bug reports, no CVE triage, and no field-tested edge cases. You would effectively be the first production user, so weigh that against writing roughly fifty lines of HTTP and validation logic yourself.
- Can I use pwiejak/recaptcha-bundle in a Laravel application?
- Not realistically. You would either have to run the Symfony Form, Validator and DI components standalone inside Laravel, or vendor a few classes out of the bundle, at which point you have taken on fork maintenance to avoid writing a small service class. The cleaner route is a dedicated service that POSTs the token to Google's siteverify endpoint, wrapped in a Laravel validation rule, with the secret read from your existing secrets manager.
- How do I test forms protected by pwiejak/recaptcha-bundle?
- The bundle delegates verification to a service, so the practical approach is to swap or mock that service in your test environment and assert that validation passes or fails as expected. Because the fork ships no CI configuration or release history, you should assume you are writing all of the test coverage yourself, including the network-failure paths. Never let automated tests hit Google's live siteverify endpoint.
- How does the bundle handle a network failure or timeout reaching Google's siteverify endpoint?
- This is not documented and must be confirmed by reading the code or asking the maintainer. The critical question is whether verification fails open, letting unverified submissions through, or fails closed, blocking legitimate users during an outage. For a spam-protection layer you generally want an explicit timeout, a logged failure, and a deliberate decision about which direction to fail.
- What are the alternatives to pwiejak/recaptcha-bundle?
- For Symfony, the upstream EWZRecaptchaBundle is the default fallback because it has real consumers and issue history. Google's official reCAPTCHA Enterprise client library removes the need for a bundle entirely and is the better fit if you need v3 scores or Enterprise features. For Laravel, skip all of these and implement siteverify directly behind a small service class and a validation rule.