muazzambuilds/filament-turnstile

Cloudflare Turnstile panel plugin for Filament v5 — register once, auto-protect login (and optionally registration / password reset).

v1.0.0 2026-07-13 13:21 UTC

Requires

• php: ^8.2
• filament/filament: ^5.0
• illuminate/contracts: ^11.0|^12.0
• illuminate/http: ^11.0|^12.0
• illuminate/support: ^11.0|^12.0
• spatie/laravel-package-tools: ^1.16

Requires (Dev)

• orchestra/testbench: ^9.0|^10.0
• phpunit/phpunit: ^11.0

MIT

• Muazzam Builds

• captcha
• laravel
• cloudflare
• filament
• filament-plugin
• turnstile

Published on Packagist.org on 2026-07-13 13:31 UTC

README

Cloudflare Turnstile panel plugin for Filament v5. Register it once on a panel and login is protected automatically — optionally registration and password-reset request too. No form schema edits for the common case.

Requirements

Dependency	Version
PHP	^8.2
Laravel	^11 / ^12
Filament	^5.0

Installation

composer require muazzambuilds/filament-turnstile

Publish the config (optional):

php artisan vendor:publish --tag=filament-turnstile-config

Add your keys to .env:

TURNSTILE_SITE_KEY=your-site-key
TURNSTILE_SECRET_KEY=your-secret-key

Create a widget and get keys at dash.cloudflare.com → Turnstile.

Usage

Panel plugin (recommended)

Call ->plugin(...) after ->login() / ->registration() / ->passwordReset() so the plugin can swap the auth page classes:

use MuazzamBuilds\FilamentTurnstile\TurnstilePlugin;

public function panel(Panel $panel): Panel
{
    return $panel
        ->login()
        ->registration()
        ->passwordReset()
        ->plugin(
            TurnstilePlugin::make()
                ->protectRegistration()   // opt-in
                ->protectPasswordReset()  // opt-in (request page only)
        );
}

Defaults: login is protected; registration and password-reset request are not.

Widget options

TurnstilePlugin::make()
    ->theme('auto')      // auto | light | dark
    ->size('flexible')   // normal | flexible | compact
    ->language('en-US')
    ->enabled(true);

Manual form field

For custom auth pages or any Filament form:

use MuazzamBuilds\FilamentTurnstile\Forms\Components\Turnstile;

Turnstile::make('cf-turnstile-response')
    ->theme('dark')
    ->size('compact')
    ->turnstileAction('contact');

Disable auto-swap and extend or compose yourself:

->login(CustomLogin::class)
->plugin(TurnstilePlugin::make()->protectLogin(false))

Custom auth pages

Extend the packaged pages or use the trait:

use MuazzamBuilds\FilamentTurnstile\Pages\Auth\Login as TurnstileLogin;

class Login extends TurnstileLogin
{
    //
}

Local / CI testing

Cloudflare test keys (any hostname, including localhost):

Purpose	Site key	Secret key
Always passes	1x00000000000000000000AA	1x0000000000000000000000000000000AA
Always blocks	2x00000000000000000000AB	2x0000000000000000000000000000000AA

If keys are missing, the widget is hidden and server validation is skipped so local apps without Turnstile still boot.

Configuration

// config/filament-turnstile.php
return [
    'site_key' => env('TURNSTILE_SITE_KEY'),
    'secret_key' => env('TURNSTILE_SECRET_KEY'),
    'verify_url' => env('TURNSTILE_VERIFY_URL', 'https://challenges.cloudflare.com/turnstile/v0/siteverify'),
    'theme' => env('TURNSTILE_THEME', 'auto'),
    'size' => env('TURNSTILE_SIZE', 'flexible'),
    'language' => env('TURNSTILE_LANGUAGE'),
    'reset_event' => env('TURNSTILE_RESET_EVENT', 'turnstile-reset'),
];

Publish views

php artisan vendor:publish --tag=filament-turnstile-views

Testing this package

composer install
composer test

Support

If this package helps you, consider supporting development:

License

MIT — see LICENSE.