ALTCHA Spam Protection: Configuration
Settings of the ALTCHA Spam Protection module for OXID 7: challenge, honeypot, rate limiting, challenge endpoint and content validation with the real admin labels, defaults and validation rules.
ALTCHA Spam Protection: Configuration
Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net
The settings are in the module settings of the module "ALTCHA Spam Protection" in the OXID admin. The headings below correspond to the groups the admin shows in English, and the labels to the fields.
General Settings
| Setting | Key | Default | Effect |
|---|---|---|---|
| Enable spam protection | mmd_altcha_enabled |
On | Master switch. Off: no checks, no widget, and the challenge endpoint answers with 503 |
| Enable content validation | mmd_altcha_content_validation_enabled |
On | Checks form contents for gibberish and disposable email domains (see below) |
ALTCHA Proof-of-Work
| Setting | Key | Default | Effect |
|---|---|---|---|
| Enable ALTCHA | mmd_altcha_pow_enabled |
On | Shows the widget and requires a valid solution. Off: honeypot, content validation and rate limiting keep running |
| Maximum number (difficulty) | mmd_altcha_max_number |
50000 | Upper bound of the secret number. The higher it is, the more computing work in the browser |
| Challenge validity (seconds) | mmd_altcha_expiry_seconds |
300 | How long a challenge is valid. Also determines the expires_at value of its entry in mmd_altcha_used_challenges |
| HMAC secret key | mmd_altcha_hmac_secret |
empty | Signs the challenges and keys the IP hashes. If left empty, the module generates 32 random bytes (Base64) on first access and saves them |
"Maximum number" and the time values expect positive integers. Text or 0 as "Maximum number" makes the challenge endpoint answer with status 500.
If the HMAC secret key changes, already issued challenges become invalid and all stored IP hashes no longer match the new ones. Rate limiting then effectively starts from scratch.
Honeypot
| Setting | Key | Default | Effect |
|---|---|---|---|
| Enable honeypot | mmd_altcha_honeypot_enabled |
On | Adds a hidden field. A filled field rejects the submission |
| Honeypot field name | mmd_altcha_honeypot_field |
website | Name (and ID) of the hidden field |
Browser autofill or password managers can fill hidden fields even when a real visitor submits the form. If that happens in your shop, choose a field name that autofill does not recognise.
Rate Limiting
This group holds the settings for the forms and those for the challenge endpoint.
Forms
| Setting | Key | Default | Effect |
|---|---|---|---|
| Enable rate limiting | mmd_altcha_ratelimit_enabled |
On | Limits submissions per client address and form |
| Maximum requests | mmd_altcha_ratelimit_max_requests |
5 | Allowed submissions within the time window |
| Time window (minutes) | mmd_altcha_ratelimit_window_minutes |
60 | Length of the time window in minutes |
The limit applies separately to the contact form, newsletter and registration. Submissions that passed honeypot, content validation and ALTCHA are counted, regardless of whether OXID accepts the submission afterwards. When the limit is reached, the visitor sees the message "Too many requests. Please wait a moment." followed by "Please wait N seconds.", where N is the whole time window in seconds.
Challenge endpoint
| Setting | Key | Default | Effect |
|---|---|---|---|
| Challenge endpoint rate limit | mmd_altcha_challenge_ratelimit_enabled |
On | Limits calls to the challenge endpoint (DoS protection) |
| Max challenges per minute | mmd_altcha_challenge_ratelimit_max |
30 | Allowed calls per client address within the time window |
| Challenge time window (seconds) | mmd_altcha_challenge_ratelimit_window |
60 | Length of the time window in seconds, rounded up to whole minutes internally |
The label "Max challenges per minute" is only accurate with the default time window of 60 seconds. In fact the time window below it determines what the number refers to.
Logging
In the group "Logging" the admin shows the option "Log spam attempts" (mmd_altcha_log_spam_attempts). The option has no effect in the code: the module does not log blocked attempts, however it is set.
Content validation in detail
Content validation only runs when the form supplies evaluable fields. It counts flagged fields and only rejects once at least two fields are flagged.
A disposable email address alone does not trigger a rejection. It counts as one flagged field and only leads to rejection together with at least one more flagged field (for example gibberish in a name). For a newsletter subscription with only an email address, content validation can therefore never reject.
Fields checked
| Form | Gibberish check | |
|---|---|---|
| Contact, newsletter | Email address | First name, last name |
| Registration | Email address (lgn_usr) |
First name, last name, street, city |
Fields shorter than 4 characters are skipped, and of longer input only the first 200 characters are checked.
Gibberish detection
A field counts as gibberish as soon as one of these rules applies:
| Rule | Threshold |
|---|---|
| Consonant share of the letters (a-z, ä, ö, ü) | Above 75 percent, above 90 percent for at most 7 letters. Vowels are a, e, i, o, u, y, ä, ö, ü |
| Keyboard sequences | asdf, sdfg, dfgh, fghj, ghjk, hjkl, zxcv, xcvb, cvbn, vbnm, qwert, werty, ertyu, rtyui, tyuio, yuiop, qwertz, wertz |
| Repeated characters | 3 or more identical characters in a row |
| Consecutive consonants | 6 or more consonants in a row (y does not count as a consonant) |
| Consonant clusters | 2 or more groups of 4 or more consonants each |
| Bigrams | With at least 5 letters, fewer than 30 percent of the letter pairs are in the list of 211 known pairs |
Disposable email domains
The domain of the email address is compared (in lowercase) exactly against a built-in list of 56 domains. Subdomains are not detected, and the list cannot be extended in the admin.
guerrillamail.com, guerrillamail.de, guerrillamailblock.com, guerrillamail.info, guerrillamail.biz, guerrillamail.net, guerrillamail.org, grr.la, sharklasers.com, mailinator.com, mailinator.net, mailinater.com, tempmail.com, temp-mail.org, temp-mail.de, throwaway.email, throwaway.com, yopmail.com, yopmail.fr, dispostable.com, discard.email, mailnesia.com, maildrop.cc, fakeinbox.com, mailcatch.com, trashmail.com, trashmail.me, trashmail.net, trash-mail.com, tempail.com, tempr.email, tempmailo.com, tempomail.fr, tempinbox.com, tempmailaddress.com, mohmal.com, burner.kiwi, minutemail.com, emailondeck.com, getnada.com, mailsac.com, harakirimail.com, tmail.ws, emailfake.com, crazymailing.com, mailtemp.net, incognitomail.org, spamgourmet.com, mytemp.email, mailnull.com, spamcero.com, jetable.org, mailtothis.com, mailexpire.com, emailisvalid.com, trashymail.com
Examples
Shop behind a corporate network with many simultaneous buyers: Many visitors share one address. Raise "Maximum requests" to 20 and leave "Time window (minutes)" at 60.
Stricter limit against contact form spam: Set "Maximum requests" to 3 and "Time window (minutes)" to 120, which allows at most 3 submissions per form and address in two hours.
Narrowing down false positives from content validation: Switch off only "Enable content validation". ALTCHA, honeypot and rate limiting stay active.