ALTCHA Spam Protection
Description
Highlights
About the Extension
The Problem: Spam in Shopware Forms
Contact forms, newsletter sign-ups, and customer registrations are popular targets for bots. Classic CAPTCHA solutions protect against this – but at the cost of privacy, cookies, and external dependencies.
This plugin protects Shopware forms with ALTCHA – a privacy-friendly proof-of-work method that works without cookies, without tracking, and without an external CAPTCHA service. I built it as a chain of checks: every layer can be switched on or off individually and configured per sales channel.
Core Features
- ALTCHA Proof-of-Work: A widget solves a cryptographic challenge in the browser. This makes automated bulk spamming expensive, while real visitors barely notice it.
- Honeypot Field: A hidden form field catches bots that fill in every field automatically. No impact on real visitors.
- Minimum Fill Time: A signed timestamp detects submissions faster than a human could type (default: 3 seconds).
- Gibberish Detection (optional): Scores name, subject, message, and address fields from 0 to 100. An observe-only mode logs suspicious entries without rejecting anyone, so you can tune the thresholds at your own pace.
- Disposable E-Mail Block (optional): Rejects addresses from known throwaway providers. It ships with a list of around 9,000 domains, your own block and allow lists per sales channel, and a searchable view of the blocked domains right in the configuration.
- IP Rate Limiting: Limits form submissions per IP address and time window. IP addresses are stored only as an HMAC-SHA256 hash.
- Replay Protection and Challenge Endpoint Protection: Already-used challenges are rejected, and the /altcha/challenge endpoint has its own rate limiting.
How It Works
After installation via the Shopware Store, the plugin is active with sensible defaults: ALTCHA, honeypot, minimum fill time, and rate limiting run immediately. You switch on gibberish detection and the disposable e-mail block when you need them under Settings > System > Plugins.
The widget is embedded automatically in the contact form, newsletter sign-up, and registration. No template changes required.
Compatibility
Tested with Shopware 6.7.x and PHP 8.2+.
Requirements
- Shopware 6.7.x
- PHP 8.2 or newer
- Valid plugin licence
Use Cases
- Shops with high spam volume in the contact form
- Newsletter operators who want to prevent fake sign-ups
- Shops that want to do without external CAPTCHA services
- Shops that see throwaway addresses in registrations and enquiries
Important Notes
This plugin supports Shopware 6.7.x only. When updating from version 1.x to 2.0, ALTCHA moves to the current protocol: clear the cache after the update, including the HTTP cache and any CDN. If your theme overrides one of the form templates, the override has to adopt the new widget markup and call parent().
Gibberish detection knows German, English, French, Spanish, Italian, and Dutch; text in other languages can score high, so I recommend starting in observe-only mode. The disposable domain list is a snapshot and never complete. When the disposable e-mail block is enabled globally, a weekly task downloads the public list again – no visitor data is transmitted.
Details
- Available: English, German
- Latest update: 8 October 2026
- Publication date: 18 August 2026
- Version: 2.0.0
- Category: Special features
Resources
Reviews (0)
About the Extension Partner
Markus Michalski
Partner Status
-
Shopware
Extension Partner
Details
- Partner since: 2026
- Extensions: 8
Support
- Based in: Germany
- Speaks: German, English
- Response time: Very quickly