Meet Shopware Payments Fast. Powerful. Yours to control. Discover payments
Diese Seite ist auch auf Deutsch verfügbar.
Shopware 6 Shopware 5
⌘ Ctrl
Wishlist
Markus Michalski

ALTCHA Spam Protection

by Markus Michalski
Rating: no rating ( write a review )
Downloads: <10
Skip image gallery
MmdAltchaIntegration
MmdAltchaIntegration
MmdAltchaIntegration
MmdAltchaIntegration
MmdAltchaIntegration
MmdAltchaIntegration
MmdAltchaIntegration
MmdAltchaIntegration
Spam protection designed for GDPR requirements: ALTCHA, honeypot, IP rate limiting, and content validation for contact, newsletter, and registration forms. No cookies.
15% discount In comparison to the regular monthly price
Add to cart
Compatible with:
6.7.0.0 - 6.7.13.0
Includes:
The subscription starts with a free trial month during which it can be canceled at any time.
During the subscription all released updates are included for free
In case you have any questions or problems with your extension you can always ask the Extension Partner for help during the subscription.

Description

Highlights

  • - ALTCHA instead of CAPTCHA – no tracking, no cookies, GDPR-compliant
  • - 4-layer protection: proof-of-work, honeypot, rate limiting, and content validation
  • - Protects contact, newsletter, and customer registration forms
  • - Fully configurable in admin – adjustable per sales channel
  • - No external services or third-party APIs required

Features

  • - ALTCHA proof-of-work widget – server-side, no external APIs
  • - Honeypot field for invisible bot detection
  • - IP-based rate limiting for form submissions
  • - Content validation: gibberish detection, keyboard patterns, disposable emails
  • - Replay attack prevention via database challenge tracking
  • - DoS protection for the challenge endpoint (/altcha/challenge)
  • - Automatic cleanup of old entries via scheduled task
  • - SHA-256 hashed IP storage – designed for GDPR requirements
  • - Protection for contact, newsletter, and registration forms
  • - Fully configurable in admin (per sales channel)
  • - Adjustable ALTCHA challenge difficulty (max number)
  • - Shopware snippet system for widget texts (i18n-ready)
  • - No cookies, no tracking, no external services

About the Extension

The Problem: Spam in Shopware Forms

Contact forms, newsletter sign-ups, and customer registrations are popular targets for bots. Classic CAPTCHA solutions protect against this – but at the cost of privacy, cookies, and external dependencies.

This plugin protects Shopware forms with ALTCHA – a privacy-friendly, server-side proof-of-work method that works without cookies, without tracking, and without external APIs.


Core Features

  • ALTCHA Proof-of-Work: An invisible widget solves a cryptographic challenge in the browser. Bots fail; real users barely notice.
  • Honeypot Field: A hidden form field reliably traps bots without impacting legitimate users.
  • IP Rate Limiting: Limits form submissions per IP address and time window. Configurable in the admin.
  • Content Validation: Detects gibberish text (including bigram frequency analysis), keyboard patterns, and disposable email addresses. Only triggers when multiple fields are suspicious simultaneously – minimising false positives.
  • Replay Attack Prevention: Used ALTCHA challenges are tracked in the database and rejected.
  • DoS Protection for the Challenge Endpoint: Rate limiting on /altcha/challenge prevents flood attacks.

How It Works

After installation via the Shopware Store, the plugin is active immediately. All four protection layers are enabled by default and can be configured individually in the admin under Settings > System > Plugins – also per sales channel.

The ALTCHA widget is automatically embedded in the contact form, newsletter sign-up, and registration form. No template changes required.


Requirements

  • Shopware 6.7.x
  • PHP 8.2 or newer
  • Valid plugin licence

Use Cases

  • Shops with high spam volume in the contact form
  • Newsletter operators who want to prevent fake sign-ups
  • Shops that need GDPR-compliant alternatives to external CAPTCHA services
  • Operators required to store IP addresses only as hashes

Important Notes

Content validation only triggers when at least two fields simultaneously contain suspicious content – this keeps false positives rare.


Documentation

You will find the complete documentation here: Plugin Documentation

Details

  • Available: English, German
  • Latest update: 5 August 2026
  • Publication date: 18 August 2026
  • Version: 1.2.6
  • Category: Special features

Resources

Reviews (0)

Write a review

If you downloaded this extension you can write a review in the Shopware Account.

Write a review

About the Extension Partner

Markus Michalski

Markus Michalski

See all extensions

Partner Status

  • Shopware Extension Partner Shopware
    Extension Partner

Details

  • Partner since: 2026
  • Extensions: 7

Support

  • Based in: Germany
  • Speaks: German, English
  • Response time: Very quickly