ALTCHA Spam Protection
ALTCHA spam protection for OXID eShop 7: proof-of-work widget, honeypot, content validation (gibberish, disposable domains) and rate limiting for contact, newsletter and registration.
This documentation always describes the latest published version.
ALTCHA Spam Protection
Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net
Overview
Spam protection for the contact form, the newsletter subscription and the registration in OXID eShop 7. The module combines an ALTCHA proof-of-work widget with a honeypot field, content validation and IP-based rate limiting. Visitors do not solve image puzzles: the browser computes a small task on submit.
Privacy: The module sets no cookies and stores IP addresses only as a hash. The widget script, however, is loaded from the CDN
cdn.jsdelivr.net, so the CDN operator receives the visitor's IP address and user agent. Details are on the Privacy page.
graph LR
A["Page with form"] --> B["Widget script from cdn.jsdelivr.net"]
B --> C["Fetch challenge from the shop"]
C --> D["Browser solves the task on submit"]
D --> E["Check chain in the shop"]
E --> F{"All checks passed?"}
F -->|"Yes"| G["OXID processes the form"]
F -->|"No"| H["Error message in the form"]
Documentation
| Page | Content |
|---|---|
| Installation | Composer and manual, activation, update, uninstall |
| Configuration | All settings, content validation, examples |
| Storefront | Protected forms, templates, widget, ViewConfig, other themes |
| Challenge endpoint | Request, response, status codes, solution |
| Extending | Checking your own forms, rejection reasons |
| Privacy | Processed data, external request, retention |
| Troubleshooting | Common problems and known limitations |
| Technical | Check chain, extended classes, tables |
Features
| Feature | Description |
|---|---|
| ALTCHA proof-of-work | The browser solves a task signed by the shop, every solution is valid only once |
| Honeypot | Hidden field that only bots fill in |
| Content validation | Detects gibberish in names and addresses as well as disposable email domains from a built-in list of 56 domains |
| Rate limiting | Database-backed limiting per client address and form |
| Challenge endpoint protection | Separate rate limit for fetching challenges |
| Apex theme | Templates for contact, newsletter and registration included for the Apex theme |
Protected forms
- Contact form
- Newsletter subscription
- Registration on the page
cl=register
Registration during checkout and all other forms are not protected. Details are on the Storefront page.
Requirements
| Requirement | Version | Notes |
|---|---|---|
| OXID eShop | oxid-esales/oxideshop-ce ^7.0 |
Templates for the Apex theme only |
| PHP | 8.2 or higher | |
| License | required |
License
Commercial license - single installation license:
- CE/PE license: One OXID eShop installation
- EE license: One OXID eShop installation incl. all subshops
Development and staging environments included. 12 months of free updates.
See the LICENSE file for full terms.
Support
For questions and support, contact Markus Michalski.
Email: support@markus-michalski.net