Feature Request: Altcha integration #797

I've used Liberaforms for a while, I noticed LiberaForms doesn’t have any verification when user submits a form. This leads bots to submit forms without any check. I suggest to integrate Altcha for Liberaforms, so that before the user submits the form, they have to pass the captcha. This will help to prevent spam/bot submissions and make the forms more secure.

"When integrating the widget into website forms, consider that users without JavaScript enabled in their browsers will be unable to utilize or submit forms protected by the widget. Ensure your audience is aware of this requirement for seamless form submission."

Related to: #178

Sounds like a possibly good solution to prevent bots from opening new accounts...
Or maybe the honeypots code (e3a55edc88) already available on user forms can be enabled by default on registration form?

I manage the rather new Liberaforms instance at address https://formulaire.facil.services/ and unfortunately only a few weeks after turning on public registration I was forced to turn it off after a massive wave of fake accounts/forms hit our server.

Hello,

unfortunately only a few weeks after turning on public registration I was forced to turn it off after a massive wave of fake accounts/forms hit our server.

Sorry to hear that.

Or maybe the honeypots code (e3a55edc88) already available on user forms can be enabled by default on registration form?

Definitely will do that. Thanks for the idea.

By the way, we've been working on backend rate-limiting. Mainly to handle public form endpoints, but also user landing pages like User registration.

https://codeberg.org/LiberaForms/server/src/branch/develop/docs/limiter.md

Another option might be Cap.js which is a "Self-hosted CAPTCHA for the modern web based on proof-of-work."

@millette wrote in #797 (comment):

Another option might be Cap.js which is a "Self-hosted CAPTCHA for the modern web based on proof-of-work."

Cool! I will need to take a closer look though and I'm a bit overloaded at the moment. But yes, it would be good to include. Thanks!

Merged user registration honeypots. Expect it in the next release.

I was forced to turn it off after a massive wave of fake accounts/forms hit our server.

@mathieugp I'd be very interested to know if rate-limiter plus honeypots make a difference for you.

@buttle I will for sure try out the new code + rate limiting and let you know! Thanks! 😄

@buttle I updated https://formulaire.facil.services to v4.9.2, turned on rate limiting and re-enabled public registration. The experiment has begun... 😸