search

altcha-org / altcha

GDPR compliant, self-hosted CAPTCHA alternative with PoW mechanism and advanced anti-spam filter.
https://altcha.org
MIT License
507 stars 17 forks source link

Got a spamwave over my contact form with altcha enabled #71

Closed Kimosaj closed 2 weeks ago

Kimosaj commented 1 month ago

Hello, the last days I got a massive spam wave over the form of my homepage, but Altcha was integrated. I use the Wordpress plugin with Forminator. Whit this website I was able to test the protection of my form and had to notice that the box for the Altcha check wasn't shown and I could fill the form and send it without any check. If you need further information I will try to help as best I can.

ovx commented 1 month ago

Hi, if the widgets isn't showing, make sure that the Forminator integration is enabled in the ALTCHA's plugin settings (by selecting "Captcha"). If you have the integration enabled, there might be some other problem - is there something in the developer console of the browser indicating why isn't the widget showing?

Kimosaj commented 1 month ago

I don't know if it's clear what I meant. If you are visiting the homepage everything is working fine with the contactform. The Altcha box is showing and is blocking every message which hasn't checked this box. So in the normal use case it works like it should. But with the website I linked above the code of my contactform is somehow copied and modified. Than it loads this modified code and this is the point where Altcha is gone and you can send messages without the protection. That's why I'm thinking it's not necessarily a problem of my website, but I will check the developer console anyway.

ovx commented 1 month ago

If you're using the ALTCHA plugin and the Forminator integration is enabled in the plugins settings, submissions to Forminator won't go through unless the form payload includes altcha field with the solution to the challenge. So if a bot (or the referred website) changes the HTML code and removes the ALTCHA widget, submissions won't be accepted. If you don't use the official plugin and integrated the widget differently, the altcha field must be checked before accepting the submitted data.

ovx commented 1 month ago

@Kimosaj Hi, so it turns out, Forminator did some changes and it stopped working with ALTCHA plugin - this issues is fixed in the plugin version 1.11.1.

Kimosaj commented 1 month ago

This sounds nice. I'm sorry for not responding the last days. If everything is fixed after the update, I would be very happy.

Kimosaj commented 2 weeks ago

The new update fixed the problem. And now the error message appears as expected when I use the website that manipulates my homepage code. So no spam in the future. Thanks for your great work. 😃