Laravel
TrustCaptcha – Bot protection

Laravel CAPTCHA Integration

Wire TrustCaptcha into a Laravel controller — or, even cleaner, into a custom Form Request validation rule — in just a few lines of PHP. Stop bot-driven spam on logins, signups and contact forms without breaking @csrf or your existing validation pipeline. EU-hosted, GDPR-ready, no image puzzles.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or select an existing one. If you’re unsure whether TrustCaptcha is right for you, try our CAPTCHA service risk-free for 14 days at no cost.

On the CAPTCHA overview page, you will find all the important information, such as the site key and licence key, and you can also create your API key. Allow your websites to access your CAPTCHA by simply adding them to the access authorised domain list in the CAPTCHA security rules.

Start of the CAPTCHA creation form.
CAPTCHA security rules of a demo CAPTCHA.

2. Add the CAPTCHA widget to your Blade template

Drop the TrustCaptcha widget into the Blade template that renders your form. The widget runs the CAPTCHA in the background and adds a hidden tc-verification-token field on submit, which arrives on $request like any other input.

resources/views/contact.blade.php
HTML
<script type="module" src="https://cdn.trustcomponent.com/trustcaptcha/3.0.x/trustcaptcha.esm.min.js"></script>

<form method="POST" action="{{ route('contact.submit') }}">
    @csrf
    <input type="email" name="email" required>
    <trustcaptcha-component sitekey="<your_site_key>"></trustcaptcha-component>
    <button type="submit">Send</button>
</form>

The CAPTCHA widget will then be displayed inside your form:

CAPTCHA done

Need detailed information about the CAPTCHA widget integration?
For the full widget reference — including themes, languages, custom design and more — please read our documentation.

Read the documentation

3. Validate the token in your Laravel controller

In your Laravel controller, take the verification token from $request, look up the result via our PHP library, and decide whether to accept the request.

First, install our TrustCaptcha PHP library:

Install
bash
composer require trustcomponent/trustcaptcha-php:^3.0

Then validate the token inside your controller and act on the result:

ContactController.php
PHP
use Illuminate\Http\Request;
use TrustComponent\TrustCaptcha\TrustCaptcha;

public function submit(Request $request)
{
    $token = $request->input('tc-verification-token');

    try {
        $trustCaptcha = new TrustCaptcha('<your_api_key>');
        $result = $trustCaptcha->getVerificationResult($token);
    } catch (\Throwable $e) {
        return back()->withErrors(['captcha' => 'CAPTCHA verification failed.']);
    }

    if (!$result->verificationPassed || $result->score > 0.5) {
        return back()->withErrors(['captcha' => 'CAPTCHA verification failed.']);
    }

    // CAPTCHA passed — process the request
    return back()->with('status', 'Thanks!');
}

Need detailed information about the Laravel CAPTCHA integration?
For full step-by-step instructions — including a reusable Form Request rule for projects with several protected endpoints — please read our documentation.

Read the documentation

Other backend framework instead of Laravel?
If you use a different framework, pick the matching recipe here. If your framework isn’t listed, your software developers can integrate the verification themselves using our documentation or ask our support team for a pre-built integration.

Actix Web
ASP.NET Core
Axum
Django
Echo
Express
FastAPI
Fastify
Fiber
Flask
Gin
Hapi
Laravel
Micronaut
NestJS
Next.js
Quarkus
Ruby on Rails
Sinatra
Spring Boot
Symfony

4. Congratulations 🎉

You are now protected by TrustCaptcha - congratulations!

CAPTCHA done

FAQs

Where in a Laravel app does the CAPTCHA verification go?
Inside the controller method that receives the form submission, before saving any model or sending mail. The CAPTCHA token comes in as a regular request input — read it with $request->input('tc-verification-token').
Can I plug the CAPTCHA check into Form Request validation?
Yes — that's the cleanest pattern. Build a custom rule (php artisan make:rule TrustCaptchaToken) that calls our PHP library inside its validate() method, then add it to your Form Request's rules() array. The verification then runs as part of $request->validated() like any other rule.
Does TrustCaptcha replace Laravel's @csrf protection?
No. CSRF and TrustCaptcha are independent layers — both should stay enabled. Keep @csrf in your Blade form and the VerifyCsrfToken middleware in your kernel. The CAPTCHA token only confirms that a human submitted the form.
Where should I store the CAPTCHA API key?
Add TRUSTCAPTCHA_API_KEY to your .env file and expose it through config/services.php under 'trustcaptcha.api_key'. Read it with config('services.trustcaptcha.api_key') — never commit the raw key to your repo.
Why does the field name contain a dash (tc-verification-token)?
It's the default field name the widget posts. Laravel's $request->input() and validation rules accept dashed input keys without a problem. If you'd rather use camelCase, set token-field-name="trustcaptchaToken" on the widget and adapt the controller / rule accordingly.
Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-ready, EU-hosted.

CAPTCHA start
CAPTCHA done
Puzzle-free UX
Runs in the background while visitors type — so more people finish your forms and fewer drop off.
GDPR-ready
EU-hosted and privacy-first: no cookies, encrypted transmission, automatic cleanup — with ready-to-use legal resources.
Multi-layer Security
Adaptive protection plus intelligent risk scoring stops abuse early — even when attack traffic spikes.
Full Control
Fine-tune sensitivity, set allow/block lists, and use geoblocking — you decide how strict verification should be.

Protect your Laravel application with TrustCaptcha in just a few steps!

  • EU-hosted & GDPR-ready
  • No puzzles
  • Try free for 14 days