# Captcha Protection

**Category:** Security  ·  **Min plan:** Pro  ·  **Slug:** `captcha-protection`

Add ALTCHA Sentinel verification to ALL checkout forms — fast checkout on the product page, full checkout, and every order form on landing pages. Stops bots, fake orders, and VPN spam at the door without annoying real customers.

## Video tutorial

[Captcha Protection](https://www.youtube-nocookie.com/embed/EIhgeNM11Fk)

## Features

* ALTCHA Sentinel verification on fast checkout, full checkout & landing pages
* Self-hosted — no Google reCAPTCHA, no third-party tracking
* Three security levels: Normal, High and Aggressive
* Invisible to real customers on Normal
* VPN / proxy / Tor blocking on High and Aggressive
* Strict mode: blocks orders with missing or invalid verification
* Emergency platform-wide kill-switch support can flip for you

## Why use it

Algerian COD stores get hammered by:

* **Fake orders** — random names + numbers entered by bots or competitors
* **Repeat-IP spam** — same VPN IP placing dozens of orders
* **Headless scrapers** — automated tools placing orders to test cards or harvest your inventory

ALTCHA Sentinel runs a small proof-of-work challenge in the customer's browser before the order submits. On the default Normal level real customers don't see it — the challenge solves in the background within milliseconds. Bots either fail or take too long. Nothing is filtered before the page renders: the widget always loads, and the decision to accept or reject is taken when the order is submitted.

## How to activate

1. Open **Dashboard → Add-ons** at [`/dashboard/addons`](https://dzbuild.com/dashboard/addons).
2. Find **Captcha Protection** under *Security*.
3. Click **Activate** (Pro plan required).

## Security level

The add-on has one setting, **Security level**, reached from the **Settings** button on its card:

| Level                             | What it does                                                                                      |
| --------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Normal** (default, recommended) | Invisible verification. VPN / proxy / Tor visitors are not blocked.                               |
| **High**                          | Also blocks VPN / proxy / Tor visitors.                                                           |
| **Aggressive**                    | Blocks VPN / proxy / Tor, and shows the customer a challenge to solve when they submit the order. |

Stay on Normal unless fake orders are actually costing you

Genuine buyers have been rejected at checkout on **High**. If you switch to High or Aggressive, watch your order count for a day, and switch back to Normal the moment orders drop. A blocked buyer sees a generic error and usually leaves rather than contacting you, so the loss is invisible unless you look for it.

Two things to know about changing the level:

* **One-hour grace window.** After you switch level, verifications coming from pages that were loaded under the old level keep working for one hour, so customers mid-checkout are not rejected.
* **Silent fallback.** If a level is temporarily unavailable, protection quietly reverts to Normal rather than failing or disabling the widget.

## Which forms are covered

The widget renders on:

* the **full checkout** page,
* the **product page**, including all five fast-checkout layouts,
* **landing page** order forms.

It is not applied to orders you create yourself from the dashboard. The **Digital** theme product page has no order form of its own: its buy button takes the customer to the checkout page, which carries the widget.

## How it behaves

* **Real customer**: nothing visible on Normal. On Aggressive, a challenge appears at submit.
* **Bot / headless / suspicious IP**: order is rejected with a generic error. The customer is not told they were flagged (so attackers can't iterate against the rule).
* **Strict mode**: an order with a missing or invalid verification is rejected. When the fault is on our side, for example when the verification service itself fails, orders go through rather than being blocked.
* **Fake Meta-paid traffic (High and Aggressive only)**: an order whose tracking tags claim it came from a paid Meta campaign, but which shows no genuine sign of having arrived from Facebook or Instagram, is rejected with the same generic message.
* **Verification that never completes**: if the browser cannot load or finish the challenge, for example because an ad blocker blocks it, the order is rejected with the same generic error. That is the main way a genuine customer can be blocked, and it is the reason Normal is the recommended level.
* **Changing mobile IP is fine**: a customer whose IP changes between page load and submit — CGNAT rotation, WiFi to mobile data — is no longer blocked for it.

## Emergency kill switch

If something goes wrong (you launched a campaign and verification is misbehaving for some segment), support can turn checkout verification off platform-wide. Orders start flowing without verification within seconds. Contact support if you need this.

## Tips

* Pair with [Limit Orders Per IP](https://dzbuild.com/docs/addons/limit-orders-per-ip.md) for layered defense — captcha stops bot signatures, IP limit stops human-driven spam from a single IP.
* Pair with [Advanced Order Management](https://dzbuild.com/docs/addons/advanced-orders.md) — your *Fake* sub-status will see far less use after enabling captcha.
* Captcha doesn't slow your store down. The proof-of-work runs in a Web Worker so even slow phones don't lag.
* Self-hosted means no data leaves DZBuild — unlike Google reCAPTCHA, no third party sees your customers' browsing.