Weave Code
Laravel Google Recaptcha V3 Laravel Package
timehunter/laravel-google-recaptcha-v3
Laravel Google reCAPTCHA v3 integration featuring a Blade directive to inject the script, server-side token validation against Google's API, configurable score thresholds, and support for multiple actions. Invisible spam and bot protection with no user interaction.
Laravel Google reCAPTCHA v3 provides seamless, invisible spam protection for Laravel applications using Google's score-based reCAPTCHA v3. It integrates with Laravel's validation and Blade systems, letting you render the required script, submit tokens, and verify them server-side with configurable score thresholds and action names—no user interaction required.
- Blade directive for injecting reCAPTCHA v3 scripts
- Validation rule for verifying tokens and scores
- Configurable thresholds and action names
- Laravel-native configuration and middleware support
- Simple setup via service provider and config file
Frequently asked questions about Laravel Google Recaptcha V3
- How do I install timehunter/laravel-google-recaptcha-v3 in a Laravel app?
- Install the package with Composer using composer require timehunter/laravel-google-recaptcha-v3. Laravel's package auto-discovery registers the service provider, so no manual provider entry is usually needed. Publish the config file with the vendor:publish command and add your Google reCAPTCHA v3 site key and secret key to your .env file. Then load the reCAPTCHA script on the front end and submit the generated token with your form.
- Which Laravel and PHP versions does this reCAPTCHA v3 package support?
- The package is a thin Laravel adapter, so compatibility depends on its Composer constraints for the laravel/framework and PHP versions. You should check the composer.json on the GitHub repository before committing to it and confirm the constraints match your target Laravel major and PHP runtime. Because the ecosystem evidence is limited, run a quick install and test in a staging or local environment first. Also verify the package works with config caching enabled in production.
- How do I validate a reCAPTCHA v3 token server-side in Laravel?
- The package provides a validation rule and middleware so you can verify the token either on a form request or across routes. On the client, the Google script returns a token tied to an action name, and you send that token to your Laravel endpoint. Server-side, the package posts the token and secret to Google's siteverify endpoint and returns the score. Use the validation rule for targeted forms or the middleware for broader route protection.
- How do I set a reCAPTCHA v3 score threshold in Laravel?
- reCAPTCHA v3 returns a risk score from 0.0 to 1.0 rather than a pass or fail result, so your application must decide the cutoff. The package exposes configurable score thresholds in its published config file, which you should tune against real traffic. Start permissively, log scores, and measure false positives before enforcing a strict threshold. Keep the threshold in environment config so you can adjust it without a code change.
- Does this package support Vue components and SPAs?
- The package advertises Vue component support, and the server-side verification works for any front end that can obtain a token from Google. For SPAs and Inertia or Vue apps, you still need to load the reCAPTCHA script and call execute with the correct action name before submitting the request. The package does not solve SPA routing or Content Security Policy issues for you. Plan explicit front-end work to attach tokens to API calls.
- What are the security risks of using reCAPTCHA v3 in production?
- The main risks are relying on browser-only checks, failing open silently, and mishandling token expiry or reuse. Always enforce verification on the server through the validation rule or middleware and log failures before you block traffic. Score-threshold tuning can cause false positives that lock out real users, so monitor rejection rates after rollout. Also review Google data flows with legal and privacy teams and confirm your CSP allows the required Google domains.
- How do I test reCAPTCHA v3 in Laravel without hitting Google?
- You should confirm the package behaves predictably under APP_ENV=testing and with local development keys. Many teams stub the verification layer in tests so no outbound request to Google is made. If the package does not expose a fake or mock helper, wrap verification behind your own CaptchaVerifier interface and bind a fake in the test container. That also lets you swap or fork the package later without changing product code.
- Is this package production-ready and actively maintained?
- The repository has modest community traction, so treat it as a tactical accelerator rather than a strategic dependency. Support is community-only with no vendor SLA, and the codebase is small enough that a fork is realistic under the MIT license. Pin the version, monitor the repository for abandonment and Laravel compatibility updates, and budget a small contingency for vendoring. Internal ownership should cover key rotation, threshold tuning, and incident response.
- What are good alternatives to this Laravel reCAPTCHA v3 package?
- Alternatives include other Laravel reCAPTCHA v3 wrappers, Google's official reCAPTCHA client libraries, or building a small siteverify client yourself since the API is straightforward. Some teams prefer hCaptcha, Cloudflare Turnstile, or Laravel rate limiting because they avoid Google dependencies and privacy concerns. Because this package has limited dependents, abstracting verification behind an internal interface makes swapping alternatives easier. Evaluate alternatives against your Laravel version, CSP requirements, and threshold controls.
- Where should I enable Google reCAPTCHA v3 first in my Laravel app?
- Start with one high-risk public write path such as registration, login, password reset, or a contact form rather than rolling out everywhere at once. Run in logging-only mode in staging to observe scores and false positives before enforcement. Canary the first form behind a feature flag with an independent disable switch so you can roll back without redeploying. Once thresholds are tuned, expand to checkout comments and API endpoints as needed.
Weaver
How can I help you explore Laravel packages today?