Deutsche Version

Back to overview

ALTCHA Spam Protection: Troubleshooting

Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net

Messages visitors see

Widget is not shown

Symptom: Neither the checkbox nor a honeypot field appears in the form.

1. Check in the module settings that "Enable spam protection" and "Enable ALTCHA" are on.
2. Clear the cache: vendor/bin/oe-console oe:cache:clear.
3. Check that the Apex theme is active. The module ships templates only for it; with other themes you have to include the widget yourself (see Storefront).
4. Check in the admin's module management that the module is active.

Form reports "Verification failed"

Symptom: Every submission is rejected although the form is filled in correctly.

1. Open the browser console. If https://cdn.jsdelivr.net/npm/altcha@latest/dist/altcha.min.js is not loaded (ad blocker, content security policy, network), the form has no solution in the field altcha.
2. Open the challenge URL in the browser. If it does not answer with status 200, see the section on the challenge endpoint below.
3. Check whether the HMAC secret key was changed after the page was loaded. In that case the signature of the challenge is invalid.

Message "An error occurred"

Symptom: After staying on the page for a long time or after a double click on submit, the generic error message appears.

• The challenge is older than "Challenge validity (seconds)" (default 300) or has been used before. The visitor reloads the page and submits again.
• The server time must be correct, because the age is computed from the timestamp inside the challenge.

Challenge endpoint answers 503, 429 or 500

Rate limit hits too many visitors

Symptom: Visitors get "Too many requests" although they submitted only once.

1. Check whether your shop sits behind a reverse proxy or CDN that does not set the X-Forwarded-For header. All visitors then appear with the same address and share one counter.
2. Raise "Maximum requests" or shorten the "Time window (minutes)".

The module trusts the first entry of X-Forwarded-For without verification. Without a proxy that overwrites the header, an attacker can bypass rate limiting with changing values.

Honeypot triggers for real visitors

Symptom: Real visitors get "Your message could not be sent".

Browser autofill or password managers can fill the hidden field. Change "Honeypot field name" to a name autofill does not recognise.

Content validation blocks legitimate input

Symptom: The message "Your input could not be processed" appears for real customers.

1. At least two fields must be flagged (first name, last name, email, and for registration also street and city). Check the rules on the Configuration page.
2. Switch off "Enable content validation" if the false alarms cannot be avoided otherwise. There is no exception list.

Disposable email is not blocked

• A disposable address alone is not enough for a rejection, at least one more field must be flagged.
• The domain must appear exactly in the built-in list of 56 domains. Subdomains and other providers are not detected.
• The list cannot be extended in the admin.

Registration during checkout is not protected

The module checks registration only on the page cl=register. The checkout form (cl=user) and other forms such as login or password reset run without checks.

Tables keep growing

The module does not clean up its tables itself. The instructions are on the Privacy page.

Module does not load after installation

vendor/bin/oe-console oe:module:deactivate mmd_altcha
vendor/bin/oe-console oe:cache:clear
vendor/bin/oe-console oe:module:activate mmd_altcha

If the two tables are missing, deactivate and activate the module again. Activation creates them when they do not exist.