omnishield / recaptcha

1.x-dev 2026-10-09 15:30 UTC

Requires

• php: >=8.2
• glitchr/omnishield: ^1.0@dev
• symfony/http-client: ^6.4|^7.0|^8.0

Requires (Dev)

• phpunit/phpunit: ^11.0

MIT

• Marco Meyer

• recaptcha
• google
• captcha
• antispam
• omnishield

Published on Packagist.org on 2026-10-09 16:02 UTC

README

Google reCAPTCHA for glitchr/omnishield, in its four forms - v2 checkbox, v2 invisible, v3 score, Enterprise - checked by direct calls to Google: siteverify for v2 and v3, the assessments API for Enterprise. No Google library (google/recaptcha wants PHP 8.4 and takes no HTTP client of yours).

use Omnishield\Model\Attempt;
use Omnishield\Recaptcha\RecaptchaGatewayFactory;

$gateway = (new RecaptchaGatewayFactory($httpClient))->create(['mode' => 'score', 'site_key' => $siteKey, 'secret' => $secret, 'threshold' => 0.5]);

$widget = $gateway->widget('contact');
echo $widget->html();         // api.js?render=<key>, a hidden g-recaptcha-response, a short script that asks for a token on submit

$verdict = $gateway->verify(Attempt::fromPost($_POST, $widget, $ip));
$verdict->score;              // 0.9; under the threshold: reasons ['score']

omnishield:
    gateways:
        google:
            factory: recaptcha
            options: { mode: checkbox, site_key: '%env(RECAPTCHA_SITE_KEY)%', secret: '%env(RECAPTCHA_SECRET)%' }

reCAPTCHA reaches Google and sets a cookie (_GRECAPTCHA): load it after the visitor's consent, and guard the form otherwise when they refuse (ALTCHA) - see omnishield's privacy. glitchr/ux-google keeps its own reCAPTCHA: this package neither touches nor needs it.

Documentation: the four modes, the options, the answers, the test keys, what was verified - v2 against Google with its test keys; v3 and Enterprise on answers written from Google's documentation, no key.

License: MIT since 2026-10-09; earlier versions remain published under LGPL-3.0-or-later.

Formerly omniguard/recaptcha, renamed on 2026-10-10 with its family (glitchr/omnishield).