Add ALTCHA integration

[tvalimaa]

Description

Add ALTCHA integration

Adds ALTCHA as a new CAPTCHA option in the Multi-CAPTCHA bundle — a privacy-friendly, proof-of-work based spam protection that requires no cookies, no external tracking, and no third-party data sharing.

What's included

Two operating modes (configured independently):

- Self-hosted — Mautic generates and verifies challenges locally using an HMAC secret. Zero outbound requests.
- ALTCHA Sentinel — Challenges are issued by your own Sentinel instance; Mautic only verifies the server signature locally. Still no outbound verification requests.

If both sets of credentials are filled in, Sentinel takes precedence.

New files:
- Integration/AltchaIntegration.php — integration settings with optional field design (avoids forcing both self-hosted and Sentinel fields simultaneously)
- Service/AltchaClient.php — challenge generation and verification logic, supporting both modes and configurable complexity (low / medium / high)
- Form/Type/AltchaType.php — Symfony form type for the CAPTCHA field
- EventListener/AltchaFormSubscriber.php — hooks into Mautic form submission to validate challenges
- Controller/ChallengeController.php — endpoint that serves fresh challenges per request (avoids stale challenges in cached form HTML)
- Twig/AltchaExtension.php — Twig extension for rendering the widget
- Resources/views/Integration/altcha.html.twig — settings and widget template
- Translations/en_US/messages.ini — English translations

Dependencies:
- Adds altcha-org/altcha: ^2.0 to composer.json

Key design decision

The ALTCHA widget uses a challengeurl attribute pointing to a Mautic-hosted endpoint rather than an inline JSON challenge. This is necessary because Mautic caches rendered form HTML — a baked-in challenge

would
be reused by every visitor until the form is re-saved, causing verification failures for all users.

[brafreider]

Hi Tuomas,
I have added Cap as an extra option some weeks ago, as someone flooded our forms secured with Altchas POW captcha. Cap adds some browser tests, that make it harder for spammers to automaticaly solve it. For Altcha there seem to exist go-based automatic solvers. A drawback of cap is, that it needs an extra service.
Take a look at https://github.com/brafreider/mautic-multi-captcha-bundle I wasn't sure, if the change would automatically update the open PR - using Gitlab most of the time.

Cheers,
Björn

[tvalimaa]

Hi Tuomas, I have added Cap as an extra option some weeks ago, as someone flooded our forms secured with Altchas POW captcha. Cap adds some browser tests, that make it harder for spammers to automaticaly solve it. For Altcha there seem to exist go-based automatic solvers. A drawback of cap is, that it needs an extra service. Take a look at https://github.com/brafreider/mautic-multi-captcha-bundle I wasn't sure, if the change would automatically update the open PR - using Gitlab most of the time.

Cheers, Björn

Hi Björn,

Thanks for the heads up and for adding Cap — that's a great addition, especially given the ALTCHA auto-solver issue. I've already integrated Cap from your fork into this branch, so it's now included here alongside ALTCHA (with both self-hosted and Sentinel support).

To answer your question: no, pushing to your fork doesn't automatically update a GitHub PR — you'd need to push directly to the branch the PR was opened from. But no worries, I've pulled your changes in manually.

Both integrations are fully independent — you can enable just ALTCHA, just CAP, or both depending on your needs. If you've been hit by automated ALTCHA solvers, CAP is worth considering as an alternative since it relies on browser fingerprinting rather than pure proof-of-work, making automated solving significantly harder. The trade-off is that CAP requires a self-hosted server.

All 72 tests pass.

[tvalimaa]

Now Altcha plugin should work with Altcha Sentinel / cloud service and also default self hosting: I tryed this Altcha plugin with Mautic 7.2 version