CAPTCHA bundle for Symfony

captchacore/captchacore-bundle for Symfony 6.4 LTS, 7.x and 8.x — FormType, validator constraint, controller attribute and Twig function. You choose what fits your project.

Symfony 6.4 LTS – 8.x PHP 8.2+ Composer

To the guide → Start for free

In three steps

Protect Symfony in a few minutes

1

Install the bundle

Add the repository, run composer require, register the bundle in config/bundles.php and create config/packages/captchacore.yaml.

2

Keys into .env

CAPTCHACORE_URL, site key and secret as environment variables.

3

Choose the integration path

FormType for Symfony forms, constraint for DTOs, attribute for controllers, Twig function for everything else.

Example

# composer.json: "repositories": [{"type": "composer", "url": "https://captchacore.eu/packages"}]
composer require captchacore/captchacore-bundle

// config/bundles.php
CaptchaCore\SymfonyBundle\CaptchaCoreBundle::class => ['all' => true],

# .env
CAPTCHACORE_URL=https://captchacore.eu
CAPTCHACORE_SITE_KEY=cc_pub_…
CAPTCHACORE_SECRET_KEY=cc_sec_…

// FormType
$builder->add('captcha', CaptchaCoreType::class, [
    'form_type' => 'contact',
]);

// oder als Attribut am Controller
#[RequiresCaptcha(formType: 'register')]
public function register(Request $request): Response

What you get

Built for Symfony, not just compatible

FormType

One field in the form builder renders widget and token; verification happens in handleRequest().

Validator constraint

For DTOs and API payloads: #[CaptchaCoreToken] on the property, checked like any other constraint.

Controller attribute

#[RequiresCaptcha] verifies the token before the action runs — no code in the method.

Twig function

captchacore_widget() for hand-built forms outside the Form component.

Security badge

For the Symfony login: the badge on the passport has the token checked before the password is.

Tests without network

The client is a service — replace it with a fake in tests, done.

No image puzzles

Proof of work and behavioural analysis instead of traffic lights and crosswalks — humans click once, bots compute themselves to death.

Servers in Germany

Processing on our own servers, no transfer to third countries, no cross-site tracking.

16 KB, no framework

The widget loads fast, never blocks the interface and works with keyboard and screen readers.

Frequently asked questions about Symfony

Do I need Symfony Flex?

No. You register the bundle once in config/bundles.php and keep the configuration in config/packages/captchacore.yaml — with or without Flex.

Does it work with API Platform?

Yes, via the validator constraint on your input DTOs.

Which PHP version?

PHP 8.2 or newer; Symfony 8 itself requires PHP 8.4.

All details, options and code examples: Documentation →

More integrations

WordPress WooCommerce WoltLab Suite Laravel Build your own integration