Added
- A modern captcha, active from installation: ALTCHA. It is hosted by the site itself — no account, no key, no cookie, no third-party service. The visitor sees a box that checks itself while they fill in the form: their browser performs a small calculation, which the server verifies. It protects the contact form, registration and recruitment. On update, a site without reCAPTCHA keys switches to ALTCHA; a site that had some keeps reCAPTCHA. ALTCHA makes mass submission costly for a bot; against a determined attacker, the providers below, which add their own checks, are sturdier.
- As an alternative, Cloudflare Turnstile, hCaptcha or Google reCAPTCHA v2, in Settings → Anti-bot security, with the link to each one's console. The secret key is encrypted and never displayed again. Without its two keys, a provider is replaced by ALTCHA rather than leaving the form open.
- The captcha and its messages exist in all six languages.
Fixed
- reCAPTCHA: the secret key was sent in the verification URL; it is now sent in the request body, as Google requires. The outdated link to its console is replaced, and the visitor address that is passed on follows the rule used by the rest of the site, which takes into account a proxy declared as trusted.
- When the anti-bot check has not been completed, the message is written out under the captcha, instead of a lone icon whose tooltip does not appear on a touch screen.
Security
- Passing the captcha once no longer exempts you from passing it again. Ever since the original NeoFrag, a passed captcha exempted the user from passing it again for all subsequent submissions of the same form, until the end of the session: a bot that solved a single challenge could then submit without limit. The exemption now only applies to a single resubmission, after another error in the form.
- An ALTCHA solution can only be used once: presenting it again is refused.
- The pages' security policy no longer allows Google by default: only the addresses of the chosen captcha provider, and none with ALTCHA.