pieceofcake2 / captcha

v1.0.2 2026-10-16 08:36 UTC

Requires

• php: >=8.0
• composer/installers: ^1.0 || ^2.0
• pieceofcake2/cakephp: ^2.12

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^9.6
• pieceofcake2/app: ^2.2
• pieceofcake2/phpcs-cakephp2: ^1.1
• pieceofcake2/phpstan-cakephp2: ^1.0

MIT

• recaptcha
• cakephp
• captcha
• cakephp2
• hcaptcha
• turnstile

Published on Packagist.org on 2026-10-16 09:33 UTC

README

CAPTCHA support for pieceofcake2/cakephp applications. A helper renders the widget and a component verifies the token on the server.

Provider	provider
Cloudflare Turnstile	turnstile (default)
Google reCAPTCHA v2 (checkbox)	recaptcha_v2
Google reCAPTCHA v3 (score)	recaptcha_v3
hCaptcha	hcaptcha

Documentation

• Website: https://pieceofcake2.github.io/captcha/ (日本語: https://pieceofcake2.github.io/captcha/ja/)
• Markdown: docs/README.md and the pages it links (日本語: docs/ja/README.md) (for AI tools and offline reading)

It covers the configuration, the helper and component API, reCAPTCHA v3, CSP nonces, test keys and security notes.

The Markdown documentation is also included in the Composer package, in the plugin's directory: plugins/Captcha/docs/README.md (the location depends on your installer-paths). Install the package with --dev if you only need it for development.

Requirements

• PHP 8.0+
• pieceofcake2/cakephp 2.12+

Installation

composer require pieceofcake2/captcha

Load the plugin in config/bootstrap.php (legacy layout: app/Config/bootstrap.php) and configure the provider. Keep the keys out of the repository, e.g. in config/.env.local (ignored by Git) or in real environment variables:

CakePlugin::load('Captcha');

Configure::write('Captcha', [
    'provider' => 'turnstile',
    'siteKey' => env('CAPTCHA_SITE_KEY'),
    'secretKey' => env('CAPTCHA_SECRET_KEY'),
]);

See Installation for the installer-paths setting.

Usage

class ContactsController extends AppController
{
    public $components = ['Captcha.Captcha' => ['actions' => ['add']]];

    public $helpers = ['Captcha.Captcha'];
}

// templates/Contacts/add.ctp
echo $this->Form->create('Contact');
echo $this->Form->input('message');
echo $this->Captcha->widget();
echo $this->Form->end('Send');

POST requests to add are verified before the action runs. When the verification fails, the component sets a flash message and redirects back. You can also verify manually with $this->Captcha->verify().

Reporting Issues

Please open an issue on GitHub. To report a security vulnerability, use private vulnerability reporting.

Contributing

See the contribution guidelines.

Origin

This package was created by pieceofcake2, which also maintains it. It is not a fork of another project and is not based on one.

License

The MIT License. See LICENSE.