Better CAPTCHA - About

[admin]

Better CAPTCHA is a self-hosted anti-bot protection system for SMF 2.1.x designed to improve verification without handing your visitors off to Google, Cloudflare, or another third-party CAPTCHA service.

The goal is simple:

Prove you're human without proving who you are.

Better CAPTCHA keeps verification local to your forum and adds adaptive protection that becomes stronger only when suspicious or repeated failed behavior warrants it.

• Main Features
• Fully self-hosted CAPTCHA protection
• No Google reCAPTCHA
• No Cloudflare Turnstile
• No external CAPTCHA API
• No external tracking service
• Adaptive challenge escalation
• Drag-and-drop puzzle CAPTCHA
• Native SMF visual/audio CAPTCHA fallback
• Mouse, touch, and pointer support
• Session-bound challenge validation
• Minimum submission timing checks
• Challenge expiration
• Failure throttling
• Temporary lockouts
• Honeypot protection
• Privacy-safe aggregate diagnostics
• Separate protection for registration and other SMF verification forms
• Environment/status diagnostics
• Self-healing SMF verification hooks
• Preset and fully custom protection modes
• Adaptive Protection

Better CAPTCHA does not force every legitimate visitor through the hardest possible challenge.

A normal visitor begins with the standard local verification challenge. Repeated failures progressively increase the protection level.

At the highest adaptive tier, Better CAPTCHA can switch to its drag-and-drop puzzle challenge.

The user grabs the loose puzzle piece and places it into the matching opening in the image.

The answer coordinates are kept on the server. The browser receives the rendered puzzle and an opaque challenge identifier rather than the correct answer.

Once the puzzle is active, it replaces the normal letter CAPTCHA for that attempt rather than forcing the user to complete both.

Accessibility Fallback

The puzzle is never the only available verification method.

A Use visual/audio challenge instead button restores SMF's normal locally generated visual/audio CAPTCHA for users who cannot or do not want to use drag-and-drop verification.

Protection Presets

Better CAPTCHA includes four configuration modes:

Balanced — Recommended

Designed for normal forums. Provides adaptive protection without becoming unnecessarily aggressive.

Temporary lockout: 90 seconds

Privacy First

Uses conservative escalation and minimizes retained information while remaining completely self-hosted.

Temporary lockout: 120 seconds

High Security

Escalates quickly after failed attempts and reaches the puzzle challenge sooner.

Temporary lockout: 300 seconds

Custom Settings

Allows the administrator to manually control the adaptive thresholds, visual challenge strength, timing requirements, failure limits, challenge lifetime, and lockout behavior.

Privacy

Better CAPTCHA was designed so stronger anti-bot protection does not require building visitor profiles.

Visitor-specific adaptive state and throttling information remain in the visitor's SMF session.

Optional persistent diagnostics are aggregate counters only.

Better CAPTCHA does not store:

• IP-address-based visitor histories
• usernames for CAPTCHA activity
• session identifiers in diagnostics
• individual visitor scores
• external tracking identifiers
• Protection Activity

Administrators can view privacy-safe aggregate statistics including:

• Verification attempts
• Successful verifications
• Failed verifications
• Adaptive escalations
• Temporary lockouts
• Too-fast submissions
• Expired challenges
• Challenge/session integrity failures

These counters are intended to show whether protection is actually being exercised without maintaining a visitor activity log.

Environment Diagnostics

The Better CAPTCHA administration page also reports important environment information such as:

• PHP version
• GD image support
• PHP session availability
• Cryptographic random generator availability
• Adaptive protection status
• Aggregate diagnostics status
• External CAPTCHA service status
• Puzzle CAPTCHA

Better CAPTCHA 0.1.0 includes the first production version of its local jigsaw challenge.

The puzzle:

• is generated locally
• stores its target position server-side
• uses an opaque per-challenge nonce
• supports mouse dragging
• supports touch
• supports pointer events
• invalidates challenge state through the normal verification lifecycle
• requires no external image-recognition or CAPTCHA service

The current release uses a locally generated puzzle scene, leaving room for expanded image pools and additional puzzle styles in future versions.

SMF Integration

Better CAPTCHA integrates with SMF's existing verification system rather than replacing large sections of SMF core code.

It also contains a self-healing verification-hook check so its pre-test-post verification lifecycle remains correctly registered.

Binary CAPTCHA/image responses remain isolated from normal theme output.

Uninstall Behavior

Better CAPTCHA follows the Better SMF uninstall standard.

Normal uninstall

• Removes Better CAPTCHA files
• Removes integration hooks
• Preserves Better CAPTCHA settings/data

Uninstall with Package Manager "Remove data" selected

• Removes Better CAPTCHA files
• Removes hooks
• Removes Better CAPTCHA settings and owned data

This allows administrators to uninstall or temporarily remove the MOD without automatically destroying their configuration.

Compatibility

SMF: 2.1.x
Better CAPTCHA: 0.1.0

Direct upgrades are supported from all Better CAPTCHA 0.1.0-dev builds through dev4f.

Release Status

Better CAPTCHA 0.1.0 is the first stable public release and is based directly on the live-tested dev4f code line.

The registration flow, adaptive escalation, puzzle challenge, visual/audio fallback, temporary lockouts, admin controls, diagnostics, hook lifecycle, and uninstall behavior have all gone through live development testing.