Captcha Laravel Package

Product Decisions This Supports

• Build vs. buy for bot mitigation: A captcha is commodity infrastructure. This package lets you buy (well, adopt — it's MIT) rather than build, which is almost always the right call. Reserve engineering time for differentiation, not for drawing distorted text.
• Framework-fit check before commitment: This is the critical finding — webman/captcha targets the webman runtime (Workerman-based), not Laravel. If your stack is Laravel, this is a framework mismatch and should be treated as a reference implementation rather than a drop-in dependency. If you are running webman services alongside Laravel, it's a legitimate fit for that slice of the estate.
• Protecting high-value flows: Concrete use cases this enables — registration, login brute-force throttling, password reset, comment/contact-form spam, guest checkout abuse. Each is a roadmap item with a clear abuse-cost denominator, which is how you justify the work.
• UX and accessibility trade-off: Image captchas carry real WCAG and conversion costs. Adoption of this package should be paired with a decision on fallbacks (rate limiting, honeypots, proof-of-work, or a managed provider like Turnstile/hCaptcha). This package supports the "self-hosted, no third-party dependency" branch of that decision tree.
• Data-residency / vendor-avoidance posture: Self-hosted captcha keeps user challenge data in-house and avoids adding a third-party script to the page. This is a meaningful input if you have privacy or CSP constraints that rule out hosted captcha vendors.

When to Consider This Package

Consider it when:

• Your service is built on webman (or you're standardizing on Workerman-based PHP services) and you want captcha without pulling in a hosted vendor.
• You need a self-hosted, MIT-licensed, no-telemetry challenge with minimal dependency surface.
• You want a small, forkable codebase you can vendor into your repo and own outright — at 13 stars and zero dependents, treat it as source you adopt, not a library you rely on.
• You're prototyping and want a working captcha in hours, not a procurement cycle.

Look elsewhere when:

• You're on Laravel. Use mews/captcha (Laravel-native, built on gregwar/captcha), Laravel's rate limiter, or a managed provider. Do not force a webman package into a Laravel app; the glue code you'd write is the whole cost of adoption.
• You need enterprise support, SLAs, or a security-reviewed vendor relationship. 13 stars and a single-maintainer profile is a supply-chain signal, not necessarily a blocker — but it means you are the maintainer of last resort.
• Accessibility compliance is a hard requirement. Image captchas are a poor primary mechanism for screen-reader users; prefer rate limiting plus a hosted challenge with an audio alternative.
• You need bot defense at scale (credential stuffing, scrapers). Captcha is a speed bump; pair it with rate limiting, device fingerprinting, and anomaly detection — or the captcha becomes security theater.

Adoption guardrails if you proceed: pin the exact version, vendor or mirror the source, add your own integration tests, and write down the fork criteria up front. Budget a half-day for the "what if it's abandoned" contingency — it's cheap insurance on a package this size.

How to Pitch It (Stakeholders)

To executives: Captcha on our registration and login flows is a small, well-understood control that measurably reduces spam account creation and brute-force traffic. This package is MIT-licensed and self-hosted, so there's no per-request cost, no new vendor contract, and no third-party script on our pages. The trade-off is maturity: it's a small, low-adoption project, so we'd own the code if it stalls. Total exposure is low — a few days of integration and a documented exit path — but the framework caveat matters: it fits our webman services, not our Laravel applications, where we'd use a Laravel-native option instead.

To engineering: Evaluate as a vendored dependency, not a trusted upstream. It targets webman/Workerman, has near-zero adoption, and one maintainer — so pin, mirror, test, and be prepared to fork. Integration should be under two days. Pair it with rate limiting so we're not relying on the image challenge alone, and flag the accessibility gap now rather than at audit time. If we're a Laravel shop, this is a "no" for production and a "yes" only as a design reference — recommend mews/captcha or a managed provider instead.