This documentation always refers to the latest published release.
Live demo: Try this and other plugins live, no installation, no risk: demo.markus-michalski.net
This page describes what the plugin processes technically. The legal assessment for your shop, such as the privacy policy or cookie banner, is up to you.
bundles/mmdaltchaintegration/altcha/); nothing is loaded from a CDN or a third party.GET /altcha/challenge.| Table | Content | Retention |
|---|---|---|
mmd_altcha_rate_limit_log |
HMAC-SHA256 hash of the IP address (ip_hash), action (contact_form, newsletter, registration, challenge), sales channel, timestamp |
The task mmd_altcha.rate_limit_cleanup deletes entries older than 24 hours |
mmd_altcha_used_challenge |
Nonce of the used challenge, expiry time | Deleted after the challenge has expired, also by the cleanup task |
The plugin does not store the IP address itself. The hash is created with the shop's APP_SECRET as key. If that value changes, new hashes no longer match old entries. If the cleanup task does not run (no message worker), the entries remain.
The shop does not store the signed timestamp of the minimum fill time; it only lives in the form field.
| Entry | Content |
|---|---|
| "Spam attempt blocked", "Newsletter spam attempt blocked", "Registration spam attempt blocked" | Rejection reason (reason), IP hash, sales channel |
| "ALTCHA gibberish check ..." | Action, sales channel, score and reasons such as pattern_words=60%, never the entered text |
| "ALTCHA disposable domain list refreshed" and "ALTCHA disposable domain refresh failed" | Number of domains or the error message |
During a form check the shop makes no request to third parties. The only exception is the disposable-domain list: the weekly task (only while the check is on globally) and the command mmd:altcha:update-disposable-domains download the list via GET from raw.githubusercontent.com (repository disposable-email-domains/disposable-email-domains). No visitor or form data is transmitted. If you want to rule this out, leave the disposable e-mail check off or never run the command; the shop then uses the bundled snapshot.
Without the "keep data" option the plugin removes both tables and all configuration values, see Installation.