Module configuration (2.x releases)

Changes compared to 1.x

• Switch to ALTCHA widget v3.
• Switch to the improved PBKDF2 algorithm for Proof-of-Work
• Support multiple themes, to tweak the look and feel of the widget. Read more here.
• Support multiple checkbox types (checkbox, toggle, ..). Read more here.
• Support additional display modes (overlay, bar, invisible, ..). Read more here.

The widget itself can be previewed and tested on the ALTCHA playground.

Migrating from 1.x

There is an upgrade path from 1.x, but there is a breaking change: the HTML markup of the v3 widget has changed. This means any custom styling that was applied to the previous version of the widget will probably break.

Additionally, since the Proof-of-Work algorithm has been changed - the "complexity" configuration values have been reset to the value ALTCHA recommends. The values in the previous version of the widget (max number) are not in the same ballpark as the current complexity value (now defaults to 5000).

Permissions

ALTCHA can be configured by users with the Administer altcha permission, on the /admin/config/people/captcha/altcha path. It is recommended to also grant the Administer CAPTCHA settings permission, which is provided by the CAPTCHA module. This grants access to the general captcha configuration, and makes the CAPTCHA & ALTCHA settings menu links available.

Widget configuration

The 2.x branch uses ALTCHA's v3 widget, and uses the superior PBKDF2 algorithm. The version widget has way more features than its v2 predecessor (themes, checkbox types, display modes, ..).

Most ALTCHA configuration options are explained in the form field descriptions, a few options can use some extra documentation.

Complexity

Full explanation of Proof-of-work challenge complexity can be found in the ALTCHA docs.

The module ships with the recommended complexity default of 5000. A lower complexity might reduce security against automated attacks but can enhance user accessibility. What takes less than a second on a new iPhone, might take 30 seconds on a low-end Android phone. Test with physical devices typical for your users.

Full explanation of challenge complexity can be found in the ALTCHA docs.

Floating captcha

When using the "floating" display mode, it will activate ALTCHA's "floating UI". It hides the widget on the form initially, and makes it appear on form submit. The "Floating anchor" field determines on which element the captcha popup will be anchored. By default, it uses the input[name="op"] selector. On a standard form, it looks like this:

Note: when there are multiple submit elements in the same form (e.g. multistep form wizards), this could cause some unexpected behavior. It is recommended to use the "Floating anchor" field and set it to a unique selector, which is only available on the form submit button.