CAPTCHA package for Laravel

Middleware, Blade component, facade and validation rule — captchacore/laravel registers via auto-discovery and protects routes or individual forms.

Laravel 10 – 13 PHP 8.1+ Composer

To the guide → Start for free

In three steps

Protect Laravel in a few minutes

1

Install the package

Add the repository, composer require — the service provider is discovered automatically.

2

Keys into .env

Site key, secret and widget options as environment variables — no configuration in code.

3

Form and route

<x-captchacore::widget /> in the form, middleware on the route or rule in the FormRequest. That is all.

Example

# composer.json: "repositories": [{"type": "composer", "url": "https://captchacore.eu/packages"}]
composer require captchacore/laravel

# .env
CAPTCHACORE_SITE_KEY=cc_pub_…
CAPTCHACORE_SECRET_KEY=cc_sec_…

// Route schützen
Route::post('/register', RegisterController::class)
    ->middleware('captchacore:register');

// Formular: <x-captchacore::widget form-type="register" />

// oder als Validation-Rule
'captchacore_token' => ['required', new CaptchaCoreToken('contact')],

What you get

Built for Laravel, not just compatible

Middleware

Protects whole routes or groups — the token is verified before the controller runs.

Blade component

<x-captchacore::widget /> renders the widget and script — mode, form type and language via attributes, the script only once per page.

Validation rule

For FormRequests: the token is validated like any other field, with a clean error message.

Facade

CaptchaCore::verify($token) for everything that does not fit into a form — APIs, Livewire, Inertia.

Configurable fail-open

Whether to let through or block during an outage is your decision in the config.

Timeouts & logging

Every API call has a timeout (default 3 s); errors go to the Laravel log, never to the end user.

No image puzzles

Proof of work and behavioural analysis instead of traffic lights and crosswalks — humans click once, bots compute themselves to death.

Servers in Germany

Processing on our own servers, no transfer to third countries, no cross-site tracking.

16 KB, no framework

The widget loads fast, never blocks the interface and works with keyboard and screen readers.

Frequently asked questions about Laravel

Does it work with Livewire and Inertia?

Yes. The widget attaches the token to the form; for SPA forms you fetch it via the JavaScript API and verify it with the facade.

How do I test locally?

The service offers a debug endpoint, and the facade can be faked in tests — your suite needs no network connection.

Which Laravel versions?

Laravel 10 to 13 with PHP 8.1 or newer.

All details, options and code examples: Documentation →

More integrations

WordPress WooCommerce WoltLab Suite Symfony Build your own integration