ALTCHA Spam Protection
ALTCHA spam protection for Shopware 6.7: proof-of-work widget, honeypot, minimum fill time, gibberish and disposable e-mail checks and rate limiting for registration, contact and newsletter forms
ALTCHA Spam Protection
This documentation always refers to the latest published release.
Live demo: Try this and other plugins live, no installation, no risk: demo.markus-michalski.net
Overview
Multi-layer spam protection for the Shopware 6 customer registration, contact and newsletter forms. An ALTCHA proof-of-work replaces the classic captcha: the visitor's browser solves a small computational task in the background, issued and verified by your shop itself. On top of that come a honeypot field, a minimum fill time, optional gibberish and disposable e-mail checks, and IP-based rate limiting.
Privacy: All checks run on your own server. The widget is served by the plugin instead of a CDN, and IP addresses are stored only as an HMAC-SHA256 hash. The server only downloads the disposable-domain list, without transmitting any visitor data. Details are on the Privacy page.
When activated, the plugin switches off the captchas that are active in Shopware's native captcha configuration and restores them when deactivated.
graph TD
A["Visitor submits a form"] --> B["Check chain in the shop"]
B --> C{"All active layers passed?"}
C -->|"Yes"| D["Form is processed"]
C -->|"No"| E["Rejected, reason is in the Shopware log"]
Each layer can be switched off individually and configured per sales channel. The exact order is described under Technical Details.
Documentation
| Page | Content |
|---|---|
| Installation | Installation via Store or Composer, update, scheduled tasks, uninstall |
| Configuration | All settings, gibberish detection, disposable e-mail check, rate limiting, practical examples |
| Storefront Integration | Protected forms, widget integration, Twig functions, theme overrides, custom forms |
| Privacy | Stored data, retention, logs, outgoing requests |
| API | Storefront challenge endpoint and the admin endpoint of the domain view |
| Troubleshooting | Common problems with symptom, check and solution, limitations, FAQ |
| Technical Details | Check order as a diagram, database tables, security concept, plugin structure |
Features
| Feature | Description |
|---|---|
| ALTCHA proof-of-work | PBKDF2 challenge, signed and verified by the shop, with a locally served widget |
| Honeypot field | Invisible trap field that gives away bots filling in every field |
| Minimum fill time | A signed timestamp rejects submissions arriving faster than a human can type |
| Gibberish detection (optional) | Language-independent score from 0 to 100 for name, subject, message and address, with a log-only band for tuning |
| Disposable e-mail check (optional) | Rejects addresses from known throwaway providers, with a searchable list and overrides per sales channel |
| Rate limiting | Database-backed sliding-window limit per IP hash and form |
| Replay protection | A solved challenge is accepted exactly once |
| Challenge endpoint protection | Separate rate limiting protects the /altcha/challenge endpoint |
| Multiple sales channels | Every setting can be overridden per sales channel |
Requirements
| Requirement | Version | Notes |
|---|---|---|
| Shopware | ~6.7.0 |
Shopware 6.7 only |
| PHP | >=8.2 |
|
APP_SECRET |
not empty | Used to sign challenges, form tokens and IP hashes |
License
Commercial license - single-installation license covering all sales channels and development/staging environments. The bundled ALTCHA widget and the bundled ALTCHA PHP library are MIT licensed, the disposable-domain list is CC0.
Support
Customers who bought this plugin through the Shopware Store receive technical support exclusively through the official Shopware support ticket system in the Shopware account. For general, project-related or commercial enquiries outside the Store framework: support@markus-michalski.net.