Cap CAPTCHA - Self-hosted reCAPTCHA alternative with nothing to click 1.0.7
- Author Crypoverse
- Creation date
-
- Tags
- captcha crypoverse self-hosted
Where do I sign up for Cap? Where do I buy keys?
Nowhere. Cap has no hosted service, no signup page, and nobody sells keys. You run the Cap server yourself and create your own keys in its dashboard. That is the whole design; it is what keeps visitor data on your own infrastructure. If you are not willing to run a small server, this add-on is not for you.
Do I need Docker?
It is the easiest route: Cap ships as a Docker image and needs Redis or Valkey alongside it. Anything that can run the Cap server works. It has to be reachable from your visitors' browsers, not just from your forum server.
Can I use the same site key on two forums?
You can, but don't. Cap reports them as one site and attributes every solve to that shared key, so one forum's traffic looks like the other's and the unused key sits at zero. One Cap instance can serve many sites; just create a separate key for each.
The CAPTCHA doesn't appear, but registration still works. Is it broken?
Almost certainly it isn't configured. If the instance URL, site key, or secret key is blank, the add-on renders nothing and accepts every guest. Go to Options → Basic options → Enable CAPTCHA for guests; if Cap is selected with any field empty, you will see a red warning saying exactly that. If you see it, you are not protected yet.
Why does it let people through when Cap is down?
Deliberate, and it matches XenForo's own built-in providers. If your Cap server is unreachable or returns a server error, guests are allowed through, and the error is written to Setup → Error logs. The reasoning is that a CAPTCHA outage should not lock people out of registering on your forum. The trade-off is that a broken install looks identical to a working one from the outside, which is why the admin warning and the error logging exist. If you would rather registration break than let unverified guests through, that is a few lines in Captcha/Cap.php.
There is a "Cap" link next to the CAPTCHA. Can I remove it?
No. That credit comes from the upstream Cap widget, not from this add-on, and it is deliberately not removable. The widget re-applies the link in JavaScript and pins it visible inside its own shadow DOM, so CSS will not hide it, and there is no setting to disable it.
Does this send anything to you, or to any third party?
Nothing goes to me or to any server of mine. There is no licence key and no licence callback. Server-side verification goes only to the Cap instance you configure. The one third party involved is the jsDelivr CDN, which your visitors' browsers contact for the widget script and the two assets it loads at runtime, and all three can be self-hosted instead; see the description.
My forum is on HTTPS, and the widget never loads.
Your Cap server is probably on plain HTTP. Browsers block insecure requests from a secure page, so the widget silently fails, and nobody can register. Put Cap behind HTTPS; the description has an nginx example.
Verification always fails, or the dashboard shows no solves for my key.
Check Setup → Error logs first: every failed verification is logged with the exact endpoint it contacted, so a wrong instance URL or site key shows up there immediately. To see what the forum is really using, load the registration page as a guest and view source; the widget tag contains the live instance URL and site key.
Does it work in the login and register popups?
Yes. The widget script is loaded through XenForo's JS manager specifically so it registers inside AJAX overlays, not just on full page loads.
What does it protect?
It registers as a guest CAPTCHA provider, so it applies wherever XenForo shows its guest CAPTCHA registration, the contact form, and so on. It is not a per-forum or per-post spam filter.
Which XenForo versions does it work on?
XenForo 2.2.0 and later. It will not install on 2.0 or 2.1. XenForo 2.3 is untested. I have not verified it on a 2.3 install, so I am not claiming support for it yet.
What happens if I uninstall it?
Everything it added is removed with it: the option, the phrases, the template, and the template modification. It adds no database tables or columns, and uninstalling does not depend on any external server.
Nowhere. Cap has no hosted service, no signup page, and nobody sells keys. You run the Cap server yourself and create your own keys in its dashboard. That is the whole design; it is what keeps visitor data on your own infrastructure. If you are not willing to run a small server, this add-on is not for you.
Do I need Docker?
It is the easiest route: Cap ships as a Docker image and needs Redis or Valkey alongside it. Anything that can run the Cap server works. It has to be reachable from your visitors' browsers, not just from your forum server.
Can I use the same site key on two forums?
You can, but don't. Cap reports them as one site and attributes every solve to that shared key, so one forum's traffic looks like the other's and the unused key sits at zero. One Cap instance can serve many sites; just create a separate key for each.
The CAPTCHA doesn't appear, but registration still works. Is it broken?
Almost certainly it isn't configured. If the instance URL, site key, or secret key is blank, the add-on renders nothing and accepts every guest. Go to Options → Basic options → Enable CAPTCHA for guests; if Cap is selected with any field empty, you will see a red warning saying exactly that. If you see it, you are not protected yet.
Why does it let people through when Cap is down?
Deliberate, and it matches XenForo's own built-in providers. If your Cap server is unreachable or returns a server error, guests are allowed through, and the error is written to Setup → Error logs. The reasoning is that a CAPTCHA outage should not lock people out of registering on your forum. The trade-off is that a broken install looks identical to a working one from the outside, which is why the admin warning and the error logging exist. If you would rather registration break than let unverified guests through, that is a few lines in Captcha/Cap.php.
There is a "Cap" link next to the CAPTCHA. Can I remove it?
No. That credit comes from the upstream Cap widget, not from this add-on, and it is deliberately not removable. The widget re-applies the link in JavaScript and pins it visible inside its own shadow DOM, so CSS will not hide it, and there is no setting to disable it.
Does this send anything to you, or to any third party?
Nothing goes to me or to any server of mine. There is no licence key and no licence callback. Server-side verification goes only to the Cap instance you configure. The one third party involved is the jsDelivr CDN, which your visitors' browsers contact for the widget script and the two assets it loads at runtime, and all three can be self-hosted instead; see the description.
My forum is on HTTPS, and the widget never loads.
Your Cap server is probably on plain HTTP. Browsers block insecure requests from a secure page, so the widget silently fails, and nobody can register. Put Cap behind HTTPS; the description has an nginx example.
Verification always fails, or the dashboard shows no solves for my key.
Check Setup → Error logs first: every failed verification is logged with the exact endpoint it contacted, so a wrong instance URL or site key shows up there immediately. To see what the forum is really using, load the registration page as a guest and view source; the widget tag contains the live instance URL and site key.
Does it work in the login and register popups?
Yes. The widget script is loaded through XenForo's JS manager specifically so it registers inside AJAX overlays, not just on full page loads.
What does it protect?
It registers as a guest CAPTCHA provider, so it applies wherever XenForo shows its guest CAPTCHA registration, the contact form, and so on. It is not a per-forum or per-post spam filter.
Which XenForo versions does it work on?
XenForo 2.2.0 and later. It will not install on 2.0 or 2.1. XenForo 2.3 is untested. I have not verified it on a 2.3 install, so I am not claiming support for it yet.
What happens if I uninstall it?
Everything it added is removed with it: the option, the phrases, the template, and the template modification. It adds no database tables or columns, and uninstalling does not depend on any external server.