- How do I install rahul900day/laravel-captcha in a Laravel app?
- Install it with composer require rahul900day/laravel-captcha; the service provider is auto-discovered and you publish the config with php artisan vendor:publish. Pick a driver via your .env file, render the challenge in your Blade form, and attach the validation rule to the request. Image-based drivers require GD or Imagick in the runtime image, so confirm the extension is present in your container. Realistic effort is under a day for the first form and one to two days to harden across all of them.
- Which captcha drivers does laravel-captcha support?
- The package is built around a driver and manager abstraction and ships multiple captcha types that you select through the publishable config, usually via an environment variable. It also allows custom drivers to be added behind that same interface. Check the README for your installed version to confirm the exact driver list, since third-party options such as reCAPTCHA, hCaptcha, or Turnstile may be separate additions.
- Does rahul900day/laravel-captcha support Laravel 12 and PHP 8.1?
- The package targets modern Laravel releases on PHP 8.1 and above, with Laravel 9 through 12 as the expected compatibility range. Always verify the composer.json constraints before upgrading, and reconcile the stated last release date against the actual commit history. Pin the version in CI so a framework minor upgrade does not silently change validation behaviour.
- How do I render the captcha in a Blade form?
- Render the challenge directly in your Blade template, typically beside a refresh control inside the form. Because the challenge is server-rendered, re-issue it whenever the form is redisplayed after a validation error without losing the user's other input. Keep the markup in a shared partial so every form in the app uses the same component and styling.
- How do I validate the captcha in a FormRequest?
- Add the package's validation rule to your FormRequest rules array, keyed to the captcha input field. Failures then surface as ordinary 422 validation errors, so your existing error bag and messaging work unchanged. Attach the rule at the request layer rather than inside controllers so every entry point is covered consistently.
- Does it work with Livewire and Inertia, including re-issuing the challenge after a 422?
- It works well in server-rendered Blade and Livewire forms, where the challenge can be issued and verified within the same request lifecycle. In Livewire you must re-issue the challenge after a failed validation cycle so users are not stuck with a stale challenge. Inertia and decoupled SPAs are a weaker fit because the challenge is bound to server-side session state, leaving token-authenticated API clients no natural place to hold the answer.
- Where is the captcha answer stored, in the session or cache, and does it work across multiple servers?
- Challenge state lives in server-side state, typically the session or cache store, rather than a stateless signed token. Multi-node deployments therefore need Redis or a shared database backing sessions or cache so every web node can verify the answer. Confirm the TTL and whether a challenge is single-use in the source or docs before relying on it for security-sensitive forms.
- Is rahul900day/laravel-captcha production ready and actively maintained?
- Treat it as unproven in production: roughly 108 stars, no known dependents, and a single maintainer mean little crowd-sourced hardening and a bus factor of one. It is reasonable for low-risk bot friction, but wrap it behind your own CaptchaService contract with issue and verify methods so switching to Turnstile or reCAPTCHA later is a single-class change. Reconcile the stated last release date against the real commit history before assuming active maintenance.
- Does laravel-captcha include rate limiting or attempt throttling?
- Rate limiting and attempt throttling are not documented features, so supply them yourself with Laravel's throttle middleware and login throttling. Self-hosted image and math challenges are increasingly solvable by OCR and multimodal models, so treat this package as bot friction rather than bot prevention. For login, payout, or account recovery, pair it with rate limits, honeypots, or a managed risk service.
- Is there an audio or non-visual alternative for accessibility?
- There is no documented audio or non-visual alternative, which matters because visual challenges carry WCAG 2.2 obligations. If accessibility compliance is a requirement, use a managed provider that offers audio challenges or rely on rate limiting and other non-visual defences instead. Test with a screen reader and a keyboard-only flow before shipping to production.