markocupic/contao-altcha-antispam

ALTCHA antispam form widget for Contao CMS

0.6.6 2025-12-08 19:50 UTC

Requires

• php: ^8.1
• contao/core-bundle: ^4.13 || ^5.0
• markocupic/contao-twig-assets: ^1.0
• symfony/config: ^5.4 || ^6.4 || ^7.0
• symfony/dependency-injection: ^5.4 || ^6.4 || ^7.0
• symfony/framework-bundle: ^5.4 || ^6.4 || ^7.0
• symfony/http-foundation: ^5.4 || ^6.4 || ^7.0
• symfony/http-kernel: ^5.4 || ^6.4 || ^7.0
• symfony/routing: ^5.4 || ^6.4 || ^7.0
• symfony/security-core: ^5.4 || ^6.4 || ^7.0
• symfony/translation-contracts: ^1.0 || ^2.0 || ^3.0

Requires (Dev)

• contao/easy-coding-standard: ^6.0
• contao/manager-plugin: ^2.12
• contao/test-case: ^4.13
• phpunit/phpunit: ^9.5
• terminal42/contao-mp_forms: ^5.0

GPL-3.0-or-later

• Marko Cupic

• antispam
• contao
• form field widget
• ALTCHA

README

Contao Altcha Antispam

This is a Contao CMS implementation of Altcha. The extension provides a front end form field for the Contao form generator.

ALTCHA uses a proof-of-work (POW) mechanism to protect your forms from spam and abuse. Unlike other solutions, ALTCHA is self-hosted, does not use cookies nor fingerprinting, does not track users, and is fully compliant with GDPR.

Visit https://altcha.org

Installation

You can install the package via composer:

composer require markocupic/contao-altcha-antispam

Afterwards run the database migration task:

php vendor/bin/contao-console contao:migrate

Configuration and usage

The extension runs out of the box and no further configuration is required. Nevertheless, some parameters can be configured.

The Complexity can be adjusted by modifying the minimum and maximum values of the randomly generated secret number on the server side (markocupic_contao_altcha_antispam.range_min and markocupic_contao_altcha_antispam.range_max). A lower maximum value creates a less complex challenge, requiring fewer computational iterations for the client to find a matching solution. Conversely, a higher maximum value increases the complexity, demanding more computational resources and time from the client.

Run composer install in your terminal to clear and rebuild cache if you made changes to the config.yaml file.

# config/config.yaml
markocupic_contao_altcha_antispam:
  algorithm: 'SHA-256' # optional, default is SHA-256
  range_min: 290000 # Lower limit for the complexity (optional), default is 10000
  range_max: 300000 # Upper limit for the complexity (optional), default is 100000
  challenge_expiry: 3600 # optional, default is 3600

key	default value	info	Required
algorithm	SHA-256	Choose between SHA-256, SHA-512 or SHA-384	no
range_min	10000	Complexity: Choose a higher value to increase the complexity/duration. A minimum value of the random number of at least several thousand as a "minimum required complexity" is recomended. More	no
range_max	100000	Complexity: Choose a higher value to increase the complexity/duration. The maximum value of 100,000 is a good start for most systems. More	no
challenge_expiry	3600	Choose an expiration time, so that there is not an infinite amount of time to solve the challenge.	no

Endpoint (route)

Out of the box, the extension will use the /_contao_altcha_challenge endpoint to get the challenges.