pieceofcake2 / captcha

v1.0.0 2026-10-14 07:26 UTC

Requires

• php: >=8.0
• composer/installers: ^1.0 || ^2.0
• pieceofcake2/cakephp: ^2.12

Requires (Dev)

• cakephp/cakephp-codesniffer: ^5.0
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^9.6
• pieceofcake2/app: ^2.2
• pieceofcake2/phpstan-cakephp2: ^0.2.3

MIT

• recaptcha
• cakephp
• captcha
• cakephp2
• hcaptcha
• turnstile

Published on Packagist.org on 2026-10-14 12:37 UTC

README

CAPTCHA support for pieceofcake2/cakephp applications. A helper renders the widget and a component verifies the token on the server.

Provider	provider
Cloudflare Turnstile	turnstile (default)
Google reCAPTCHA v2 (checkbox)	recaptcha_v2
Google reCAPTCHA v3 (score)	recaptcha_v3
hCaptcha	hcaptcha

Requirements

• PHP 8.0+
• pieceofcake2/cakephp 2.12+

Installation

composer require pieceofcake2/captcha

Load the plugin in config/bootstrap.php (legacy layout: app/Config/bootstrap.php) and configure the provider. Keep the keys out of the repository, e.g. in config/.env:

CakePlugin::load('Captcha');

Configure::write('Captcha', [
    'provider' => 'turnstile',
    'siteKey' => env('CAPTCHA_SITE_KEY'),
    'secretKey' => env('CAPTCHA_SECRET_KEY'),
]);

See Installation for the installer-paths setting.

Usage

class ContactsController extends AppController
{
    public $components = ['Captcha.Captcha' => ['actions' => ['add']]];

    public $helpers = ['Captcha.Captcha'];
}

// templates/Contacts/add.ctp
echo $this->Form->create('Contact');
echo $this->Form->input('message');
echo $this->Captcha->widget();
echo $this->Form->end('Send');

POST requests to add are verified before the action runs. When the verification fails, the component sets a flash message and redirects back. You can also verify manually with $this->Captcha->verify().

Documentation

Documentation: https://pieceofcake2.github.io/captcha/

It covers the configuration, the helper and component API, reCAPTCHA v3, CSP nonces, test keys and security notes.

Reporting Issues

Please open an issue on GitHub. To report a security vulnerability, use private vulnerability reporting.

Contributing

See the contribution guidelines.

License

The MIT License. See LICENSE.