License Key Required

No license key entered. Enter or update your key with php artisan news:license <key>, or purchase one at scriptgain.com.

Spam Protection

Stop contact-form and login spam. Choose a provider, or use the built-in challenge that needs no keys.

Settings

Choose A Provider

Only the selected provider runs. The baseline honeypot and time-trap always run underneath it.

None (Baseline Only) No Third Party No challenge. The honeypot and time-trap still run, so forms are never fully unprotected. Built-In Challenge (Our Own) No Third Party A signed question answered on your own server. No third party, no external script, no cookies. Best for privacy-strict or air-gapped sites. Google reCAPTCHA v2 External The familiar "I'm Not A Robot" checkbox. Widely recognised, but sends visitor data to Google. Google reCAPTCHA v3 External Invisible and score-based, with no puzzle for the visitor. Needs a tuned score threshold and sends data to Google. hCaptcha External A privacy-forward checkbox challenge and a drop-in alternative to reCAPTCHA. Cloudflare Turnstile External A privacy-forward challenge with no puzzle. A natural fit for sites already behind Cloudflare.

Built-In Challenge

Answered on your own server. No external requests, no keys.

Question Style

Arithmetic rotates a simple sum. Word rotates a short question.

Google reCAPTCHA v2 Keys

Seeded with Google's official test keys that always pass. Replace them with your own before go-live.

Site Key

Secret Key

Leave blank to keep the saved key.

Google reCAPTCHA v3 Keys

Invisible and score-based. There is no public test key for v3, so add your own keys before selecting it.

Site Key

Secret Key

Leave blank to keep the saved key.

Score Threshold

0.0 lets everything through, 1.0 is strictest. 0.5 is a sensible start.

hCaptcha Keys

Seeded with hCaptcha's official test keys that always pass. Replace them with your own before go-live.

Site Key

Secret Key

Leave blank to keep the saved key.

Cloudflare Turnstile Keys

Seeded with Cloudflare's official test keys that always pass. Replace them with your own before go-live.

Site Key

Secret Key

Leave blank to keep the saved key.

Baseline Still Active

With no provider selected, the always-on honeypot and time-trap still protect every form, so nothing is left completely open.

Test This Configuration

Runs a real round-trip against the saved provider. Save first, then test.

Built-in verifies its own signing; external providers verify the secret key is reachable and accepted.

Where It Applies

Each public entry point has its own switch. The baseline honeypot and time-trap run on all of them regardless.

Staff Login Protect /admin/login. Login is the anti-brute-force surface, so this is on by default.

Report An Issue Protect the /report-an-issue service-request intake.

Contact Form Protect the Contact Us form submission.

Public Forms Protect every other form-builder submission. (Contact Us has its own switch above.)

Baseline Protection

Always on, independent of the provider, so a form is never fully unprotected and never breaks on a missing key.

Minimum Seconds Before Submit

A form submitted faster than this is treated as a bot. Set to 0 to disable the timer. The honeypot cannot be disabled.

Fail Policy

What happens when an external provider cannot be reached.

Staff Login

Default: Fail Closed. A provider outage must not become a way past the login challenge.

Public Content Forms

Default: Fail Open. A Google outage must not stop a resident reporting a pothole. Fail-opens are logged.

Cancel