Captcha Protection

Category: Security  ·  Min plan: Pro  ·  Slug: captcha-protection

Add ALTCHA Sentinel verification to ALL checkout forms — fast checkout on the product page, full checkout, and every order form on landing pages. Stops bots, fake orders, and VPN spam at the door without annoying real customers.

Video tutorial

Features

• ALTCHA Sentinel verification on fast checkout, full checkout & landing pages
• Self-hosted — no Google reCAPTCHA, no third-party tracking
• Three security levels: Normal, High and Aggressive
• Invisible to real customers on Normal
• VPN / proxy / Tor blocking on High and Aggressive
• Strict mode: blocks orders with missing or invalid verification
• Emergency platform-wide kill-switch support can flip for you

Why use it

Algerian COD stores get hammered by:

• Fake orders — random names + numbers entered by bots or competitors
• Repeat-IP spam — same VPN IP placing dozens of orders
• Headless scrapers — automated tools placing orders to test cards or harvest your inventory

ALTCHA Sentinel runs a small proof-of-work challenge in the customer's browser before the order submits. On the default Normal level real customers don't see it — the challenge solves in the background within milliseconds. Bots either fail or take too long. Nothing is filtered before the page renders: the widget always loads, and the decision to accept or reject is taken when the order is submitted.

How to activate

1. Open Dashboard → Add-ons at /dashboard/addons.
2. Find Captcha Protection under Security.
3. Click Activate (Pro plan required).

Security level

The add-on has one setting, Security level, reached from the Settings button on its card:

Level	What it does
Normal (default, recommended)	Invisible verification. VPN / proxy / Tor visitors are not blocked.
High	Also blocks VPN / proxy / Tor visitors.
Aggressive	Blocks VPN / proxy / Tor, and shows the customer a challenge to solve when they submit the order.

Stay on Normal unless fake orders are actually costing you

Genuine buyers have been rejected at checkout on High. If you switch to High or Aggressive, watch your order count for a day, and switch back to Normal the moment orders drop. A blocked buyer sees a generic error and usually leaves rather than contacting you, so the loss is invisible unless you look for it.

Two things to know about changing the level:

• One-hour grace window. After you switch level, verifications coming from pages that were loaded under the old level keep working for one hour, so customers mid-checkout are not rejected.
• Silent fallback. If a level is temporarily unavailable, protection quietly reverts to Normal rather than failing or disabling the widget.

Which forms are covered

The widget renders on:

• the full checkout page,
• the product page, including all five fast-checkout layouts,
• landing page order forms.

It is not applied to orders you create yourself from the dashboard. On the Digital theme the widget renders on the checkout page; the Digital product page's own order form does not carry it.

How it behaves

• Real customer: nothing visible on Normal. On Aggressive, a challenge appears at submit.
• Bot / headless / suspicious IP: order is rejected with a generic error. The customer is not told they were flagged (so attackers can't iterate against the rule).
• Strict mode: any order missing or carrying an invalid token is rejected — no fallback.
• Fake Meta-paid traffic (High and Aggressive only): an order whose tracking tags claim it came from a paid Meta campaign, but which shows no genuine sign of having arrived from Facebook or Instagram, is rejected with the same generic message.
• Verification that never completes: if the browser cannot load or finish the challenge, the order is rejected with the same generic error. There is no fallback that lets it through. That is the one way a genuine customer can be blocked, and it is the reason Normal is the recommended level.
• Changing mobile IP is fine: a customer whose IP changes between page load and submit — CGNAT rotation, WiFi to mobile data — is no longer blocked for it.

Emergency kill switch

If something goes wrong (you launched a campaign and verification is misbehaving for some segment), support can turn checkout verification off platform-wide. Orders start flowing without verification within seconds. Contact support if you need this.

Tips

• Pair with Limit Orders Per IP for layered defense — captcha stops bot signatures, IP limit stops human-driven spam from a single IP.
• Pair with Advanced Order Management — your Fake sub-status will see far less use after enabling captcha.
• Captcha doesn't slow your store down. The proof-of-work runs in a Web Worker so even slow phones don't lag.
• Self-hosted means no data leaves DZBuild — unlike Google reCAPTCHA, no third party sees your customers' browsing.