Awaiting an answer SP Page Builder

Joomla 5.X and SPPageBuilder FormBuilder Captcha

Asked by Pascal 2 years ago Last activity 1 year ago

Hello Joomshaper-Team,

since allmost one year the Joomla-Developers removed all Google Captcha-Plugins.

Why did they do this? Google reduced now the free reCaptcha usages from 1.000.000 down to only 10.000 website contact formular calls. Thats not that much anymore. On the other hand there can be a problem about the DSGVO law. It is better to have everything on our own websites without Google.

I know there is a inofficial workarround to get the old Google invisible reCaptcha. But thats not an official solution.

I tried now to integrate a own captcha into the "form_builder" source code. But I failed and stopped now. I tried it some days and it is very frustrating. From the "form_builder" admin.php and site.php files I dont get access to save some information into the $SESSION or localStorage. You guys just used a hidden text field with a md5 hash for example, but I cant get access to it from my captcha files.

I was able to add a new option OwnCapcha in the admin.php. You can select it in the backend. Thats easy. I was able to display a captcha picture in the site.php, but the connection of both failed. Cant check if the captcha is true or false.

Place for a subclass of an addon:
.../templates/shaper_helixultimate/sppagebuilder/addons

I am a little bit surprised that you guys did not implement a working solution without a thirdparty dependency.
It is allmost one year ago now. The form_builder is a very important function to get in contact with the customers.

With the Google reCaptcha functionality its like they can just block the contact formular and I get no messages if they want to. Or like now they want money for their service and we have a problem.

You implemented only a simple text field with one little expression 3 + 1. This expression will never change. Thats not a real spam protection. A bot will see this, calculate it and will send spam.

Are you guys allready developing a own captcha solution in the form_builder?
When we get a official solution for the problem?

I mean your SP Page Builder is for Joomla and Joomlas decision was to remove all Google reCaptcha-Plugins. In this case I am very surprised that you guys did not update your software in the last 1 year for this very important case. Joomla remove it just about 12 months ago. Anyway I saw a lot of threads about it and no solution.

Thank you in advance!

Best regards
Pascal

34 replies

Yofie Setiawan

2 years ago

I'm also looking forward for a solution for this case. Getting many spam lately and the default captcha from the form builder doesn't help at all.

Pascal Asked this

2 years ago

Hello Yofie Setiawan,

I tried the default captcha too, but this is nothing against these spambots. Per day I get 50-100 spam emails now and needed to deactivate my contact formulars. Otherwise I will get inserted in a junk database and cant communicate anymore with my customers.

There is only a workarround to use the old Google Invisible reCaptcha, but this is not really a solution.
Official the Joomla-Team removed the support of the Google reCaptchas with the release of Joomla 5. Thats allmost 1 year ago. Looks like nobody had this on their paper.

I am really sad I was not able in a few days to implement my own captcha. It was allmost working.

I hope we get a real solution soon or at least a answer that they work on it.
Google is not really a solution anymore after they changed everything about the reCaptcha and want money now earlier. Google is even a problem, because of the data policy. We need a inbuild solution in the form_builder from Joomshaper.

Have a nice day!

Best regards
Pascal

Yofie Setiawan

2 years ago

"Otherwise I will get inserted in a junk database and cant communicate anymore with my customers."

Can you explain more about that "junk database"? Should i also be concern?

Pascal Asked this

2 years ago

Hi again,

the thing is the contact formular is sending emails with our email credentials over our webprovider. Somewhere in Joomla we set the SMTP settings for it.

In this case bots are sending spam over it and maybe in a high frequence. The webprovider of the receiver email adresses will check if our emails are spam and insert us in some of the official junk mail databases. If other email servers are using these databases we cant send emails anymore to our real customers. It allready happen to me.

Normally we use a email server and it ip address with other customers of our webprovider. It is possible that all other customers get trouble, because of us.

It is not good when bots send emails with our contact formulars.

Best regards
Pascal

Stuart Clark

2 years ago

I've just come across this issue too.

Unfortunately it seems like they another example of very sloppy coding from Joomshaper.

Equally unfortunately, they'll probably not own up or do anything to fix it!

Melissa Waldrup-Old

2 years ago

I 100% agree that something needs to be done about the Captcha options in Form Builder! I'm using Joomla 4, only because my web host is behind on upgrading MySQL. That allows me to use Google reCAPTCHA. But I would like the option to use something else, and that just isn't possible with PageBuilder. Plus, when I finally can upgrade to Joomla 5, my options will become fewer.

There needs to be the option to either choose a plugin downloaded from the JED or Joomshaper needs to build their own Captcha for Form Builder.

Pascal Asked this

2 years ago

Hello Melissa Waldrup-Old,

thats the thing. We cant go with the time now and use the newest Joomla etc. without workarrounds. Thats not good at all.

Joomla 5 got released in october 2023. Thats allmost one year ago.
With this release the Joomla team removed all Google reCaptchas. And I explained the reason above. Even because of data policies its not a option to use Google reCaptcha. On the end Google can even block our form_builder formulars and we get no informations. If Google want they just stop the submit. For example, when we reach the new limit for the reCaptcha Enterprise.

I really dont want to understand why Joomshaper dont have it on the paper. It is a very important thing. Without the Form_Builder my customers cant connect me on a easy way.

I have a lot of customers they use the Form_Builder and its just essential.
I am paying since 2021 for the Agency subscription and payed 299 Euro per year. Maybe one time with a discount on halloween. But now the prices went up to 399 Euro per year. 25% more. Thats just wow!

When I look back how much trouble I got. I found still a lot of bugs. I dont know if this is the way I want to go in the future. I needed to fix a lot with own CSS code.

Now we are waiting over 48h. Joomshaper maybe dont care or just dont have a solution yet.
I really hate it when companies dont answer or wait more then 24h.

I am really unhappy about the situation. Joomshaper should know ;-)! I am not the first guy that write about it. Allmost 1 year and no update about it. Normally a company like Joomshaper should have a product manager. Maybe he sleeped?

@Joomshaper. Would be nice when you get in and explain: Are you working on a solution? Did you check the problem about it?

Thank you in advance!

Best regards
Pascal

Melissa Waldrup-Old

2 years ago

Unfortunately, we may be waiting a while due to an internet outage.

https://www.joomshaper.com/forum/question/34046

Pascal Asked this

2 years ago

Ah, thank you for the information. I did not notice it.

Stuart Clark

2 years ago

JoomShaper - Please address this important security issue! Ignoring the problem is NOT a solution!
(for example, why can't SPPageBuilder make use of whichever Captcha plugin Joomla has set as default??)

Pascal Asked this

2 years ago

Hello Stuart Clark,

I am quite sure this is an option that will work.

I tried it by my own and failed. But I was able to select my captcha from the admin.php menu.
So thats easy. The problem is the sourcecode of the site.php. I integrated my own captcha, saw a picture. I was even able to display a nice textbox that we can type the captcha code in. But I was not able to verify the captcha.

I am quite sure a Joomshaper developer with experience can do this in just 8 hours.
I am not a PHP developer and was allmost there in 2 days, ...

It is not that hard to develope something thats more secure then the 3 * 1 expression. Thats something the most bots calculate and it is not helping against these bots. Even it is the same expression with a simple question / answer. Not a good solution. Would be better to have something random + the characters need to be overlapped with some lines etc. That will stop a lot of bots allready. I know this, because I am using it in my own php formulars from the past.

I hope Joomshaper will jump in, understand the problem and bring us a solution. Still cant belief thats he release of Joomla 5 is almost a year ago and nobody checked this. But the SP Page Builder is a product for Joomla. All updates normally need to trigger the team and not us.

Best regards
Pascal

Pascal Asked this

2 years ago

PUSH

@Joomshaper team:
I want to write another information. The workarround with the Google invisible reCaptcha V2 and Joomla 5 is not secure anymore. A lot of bots are still sending spam emails over the form_builder contact formulars.

So we have a worst case allready.

Now I am at the point that I need to deactivate all my form_builder contact formulars.
That will kill my business. I will get a big damage now and I am paying for your SP Page Builder agency plan.

Really guys. A lot of other people wrote allready about this problem. 12 months time and you did nothing. Normally you should saw it after the Joomla 5 release. Where is your product manager? He should check it and bring everything on the way to bring a solution.

Are you even aware of this big problem?
What is now the timeline?
Will you fix it?
Will you still ignore us?

Best regards
Pascal

Toufiq Senior Staff

2 years ago

Hi there,

Thank you for reaching out, and I apologize for any inconvenience caused by this oversight. I understand your frustration after reviewing the comments. I will share your feedback with our development team and get back to you with an update soon.

Best regards,

Toufiqur Rahman (Team Lead, Support)

Pascal Asked this

2 years ago

Hello Toufiq,

thank you for your short answer!

It would be nice when your team and you are working with a priority on it.
Just, because there is allmost one year gone allready after the Joomla 5 release and since then the problem born.

From now a lot of people cant use the form_builder and dont get new customers or the customers get angry. It is not a nice situation at all. In my opinion you guys was sleeping in this case ;-).

Even some customer of me are angry at me now. They have for example some healthcare formulars and get only spam and there email provider allready messaged them. Then generator no business now. This can be a problem for me too and for all other SP Page Builder user. Normally, as entrepreneurs, we are liable for these damages.

Just this week is really annoying. I get only phone calls about this problem and I have to explain why and I have no real solution yet.

Best regards
Pascal

Toufiq Senior Staff

2 years ago

In my point of view Joomla CMS should introduce new captcha function. We are trying to figure out the captcha issue. Please stay with us and allow us time. Thank you

Stuart Clark

2 years ago

@Toufiq

That is NOT a suitable answer! Rather than simply ignoring issues (which is exactly what we know will happen from your statement above), you need to actually provide a SOLUTION

You are apparently a "Senior Staff" member - but the answers we are receiving from you are what I would expect from a 1st line helpdesl who can make NO decissions.

ALL JOOOMSHAPER CUSTOMERS DESERVE BETTER SUPPORT

Toufiq Senior Staff

2 years ago

I have shared this topic with our development team. We need to wait for their decision regarding the addition of a third-party CAPTCHA. Additionally, we need to consider which CAPTCHA would be most appropriate on a global scale. I hope you will understand.

Pascal Asked this

2 years ago

Hello @Toufiq,

thank you for your answer!

In my optionion you guys need to go two ways.

You need a own good working captcha in SP Page Builder, that we have no dependencies to any other company. They can just shut there service down or want more money etc. You need to be prepared for this or we all have a problem.
It would be nice when we can use all Captcha Plugins that are installed in Joomla. This will open the market for everybody.
We Third-Party captchas can be a option, but look at Nr. 1. We need for sure a own one first. I developed one by my own and it is just proctecting me in the most cases. But I know the most captchas are not 100% secure anymore. But a own puzzle captcha etc. or a picture with a lot of lines are better then the basic one of you with the 3 * 1 question / answer. Thats nothing for the bots currently.

Have a nice day!

Best regards
Pascal

Toufiq Senior Staff

2 years ago

We are trying to figure out which will be the best and not to be depended third-party.

Stuart Clark

2 years ago

The correct and "simplest" implementation, which alse ensures ZERO third party reliance, is to support the already-existing Joomla CAPTCHA plugin format.

If you can simply use whatever is configured already in Joomla (such as the built-in Contacts component plus a hell of a lot of third party extensions already use) then you don't need to worry about which particular Captcha system is in use.

That is the obvious and simple answer to the question. It shouldn't need to be debated!

Toufiq Senior Staff

2 years ago

Yes, our development team informed me that we can add Google reCAPTCHA to the discontinued Joomla CMS. And we have to think about the future core updates of Joomla. Thanks

Stuart Clark

2 years ago

You're missing the point ONCE AGAIN!

Forget Google reCaptcha!

SIMPLY MAKE USE OF THE STILL SUPPORTED JOOMLA CAPTCHA PLUGIN SYSTEM - THE ONE WHICH LETS YOU SELECT ANY INSTALLED CAPTCHA AS SITE DEFAULT WITHIN GLOBAL SETTINGS!

WHY are you making this so complicated???

Toufiq Senior Staff

2 years ago

Got it. Thanks

Toufiq Senior Staff

2 years ago

I have explained the process to our team.

If i install any captcha plugin it should be display on form builder or contact form as like global configuration captcha option.

Thanks

Stuart Clark

2 years ago

CORRECT!

Toufiq Senior Staff

2 years ago

Thanks & Cheers!

Pascal Asked this

2 years ago

Hello @Toufiq,

I agree with the other opinions.
I am happy that you guys understood the problem.

If we install a other captcha plugin we need to be able to select it from the form_builder.
And if we use the "default" option the form_builder have to use the default captcha plugin of Joomla.

This will open the market for every Joomla developer and will even help you guys.

But at all I saw not a single secure captcha plugin. We need also a recommendation for a captcha plugin. Then we have a complete solution. Or a example of Joomshaper with a documentation ;-). Then we can work in a team on it. You definitely have to provide the interface in the form_builder.

Thank you in advance!

Best regards
Pascal

Yofie Setiawan

2 years ago

I just want to say that we urgently need this issue solve immediately as possible, since i get tons of spam form submission lately.

Toufiq Senior Staff

2 years ago

We will try to add this feature within few days. Please allow us time. Thanks

Stuart Clark

2 years ago

ALL these SECURITY fixes should be your top priority!

Melissa Waldrup-Old

2 years ago

Thanks for your reply and making this a priority, Toufiq!

Toufiq Senior Staff

2 years ago

Our development team is actively working on the CAPTCHA issue. We expect to have a solution implemented as soon as possible. Thank you for your patience.

Toufiq Senior Staff

2 years ago

@Stuart Clark We are nearing the final stages of releasing EasyStore. Additionally, please refrain from posting unusual comments on other users' forum posts. Thank you.

Stuart Clark

2 years ago

@Toufiq The Captcha issue is affecting ME too, as you'd know if you properly read the multiple threads about it!

If you want to engage in a professional manner to resolve ALL issues which JomShaper are facing, I am more than willing to act as consultant to you, for a fee.

Otherwise - please concentrate your and JoomShapers efforts on resolving issues rather than berating customers who point out the repeated failings!

Toufiq Senior Staff

2 years ago

Our developer team is working hard to release some issues. Besides, captcha need to re-design that's why we need time to implement this feature. I hope you will understand the sitiuation. Thanks

Pascal Asked this

2 years ago

Hello @Toufiq,

thank you for your answer!

I am happy that your team and you are aware now of the issue and that you are working on it.

The thing is Joomla removed it for over 12 months ago, because of the very bad changes and regulation of Google. Normally a product manager of your side had the job to know and understand these kinds of problems ;-). We cant change it now. But in the future it would be nice when you look arround whats going on. Your product is based in Joomla. Joomla was not writing a lot about it to be honest so its hard to check it after the release. But you guys should at least ask yourself why did Joomla remove these plugins. There was some reasons. I needed to understand it by myself too ;-). Took me some days.

The next thing is a lot of guys before me started a thread or talked about it on the internet and nobody reallty noticed the issue. From my side as a IT expert I dont know. I dont want to point everytime 12 months later on problems normally.

It is allready a good feeling, that you guys understood the problem and that you are working on it!

On the end we need a good working and secured solution for the future. So from now it does not matter how many more days it will take. Soon as possible is fine, but it need to work on the end :-)!

Have a nice day and good luck!

Best regards
Pascal

Toufiq Senior Staff

2 years ago

Hi Pascal,

Thank you for your message and for bringing this to our attention. We appreciate your patience and understanding regarding the situation.

We understand that Joomla removed this feature over a year ago due to significant changes and regulations from Google. Ideally, our product management team should have been more aware of these developments and the underlying reasons for such removals. Moving forward, we will certainly strive to stay more informed about the changes within Joomla and other platforms that our product relies on.

We acknowledge that this issue has been raised multiple times by other users, and we regret that it wasn't addressed sooner. Your expertise and the time you’ve taken to understand and explain the problem are greatly valued.

Our team is committed to providing a secure and functional solution as soon as possible. We want to ensure that the final result is robust and reliable, even if it takes a bit more time to achieve.

Thank you once again for your understanding and support. Have a great day!

Best regards,

Toufiqur Rahman (Team Lead, Support)

Marco M.

2 years ago · edited

Hey, here is one more person, who is wating for the Joomla Core Captcha Integration into Form Builder. Hope to see it soon. But i'm still on J4. Thanks :)

Toufiq Senior Staff

2 years ago

What we are planning to implement.

I have explained the process to our team.

If i install any captcha plugin it should be display on form builder or contact form as like global configuration captcha option.

Thanks

Yofie Setiawan

2 years ago

I'm surprised this is not included in the SPPB 5.3.5 update xD

Stuart Clark

2 years ago

I was hoping for this too! At the moment it is almost impossible to use any email form in PageBuilder!

Toufiq Senior Staff

2 years ago

We are working on it. We need time.

Pascal Asked this

2 years ago

Hello Toufiq,

can you tell us some kind of time indication?

The thing is even the workarround with the install of the Google Invisible Captcha Plugin V2 etc. is not working anymore.

Like allmost all website visitors get a unlimted amount of tasks and its like a loop for them.
So nobody can even look into the websites anymore. The Google Invisible Captcha is above everything.

On the other hand I get very big scam and my webhoster allready called me that there are to much traffic at all and it can result in a ban. Thats not good.

A lot of guys like me need these contact formulars to get new customers.
And my customers need them too for the advertising. This can really kill and remove us from the market.

Normally these scripters have to go in prision for sending spam and make our work impossible.

Thank you in advance!

Best regards
Pascal

Toufiq Senior Staff

2 years ago

We're almost there. We're aiming to release it by the end of this week.

Yofie Setiawan

2 years ago

Hi, any update regarding this? Its been a month.

Right now i receive spam form submission in every seconds, seriously in every few seconds i receive a form submission. xD

Toufiq Senior Staff

2 years ago

We have resolved the issue. Currently, we are working on adding a new feature that supports third-party captcha integration for form builder, contact forms, and opt-in forms, which is why it is taking some time. Thank you for your patience.

Melissa Waldrup-Old

2 years ago

Sounds great! Looking forward to it!

Toufiq Senior Staff

2 years ago

We have added hcaptcha inital. If you have any recommendation, Please let us know. We try to add in the future. Thanks

Pascal Asked this

2 years ago

Hello Toufiq,

nice to hear, that your team and you fixed it!

When is the new release available?

Thank you in advance and have a nice day!

Best regards
Pascal

Toufiq Senior Staff

2 years ago

Please check the latest version. Thanks

Yofie Setiawan

2 years ago

Thanks for the update team. Guys, any recommendation for good captcha plugin?

Toufiq Senior Staff

2 years ago

We just added a compatibility of hcaptcha. If you any recommendation, Please let us know. Thanks

Pascal Asked this

2 years ago · edited

Hello Toufiq,

I installed the update right now and checked it.

I used hcaptcha. I am not sure, if this is the best solution at all. It is again a third party company and we need his webserver for everything. It is not on our webserver ;-). Would be better to have a solution on our servers.

The next thing is, customers can now write something in the form_builder fields, click on submit and if they forgot to accept the hcaptcha all the written information get removed and I get no message. Thats not good. Normally the form_builder should save all information and check if the captcha is set or not.

But this thing is now better then before. I hope it will stop million of spam emails.

Edit:
I forgot something. It would be nice too, if we can select the "Default selected Joomla captcha" and then we can set it global in Joomla instead of set it manually in each of the 100 pages ;-).

King regards
Pascal

Toufiq Senior Staff

2 years ago

Would be better to have a solution on our servers.

This is a initial solution to prevent spaming. We will think about it in future.

I have informed our developer team to fix this issue.

I forgot something. It would be nice too, if we can select the "Default selected Joomla captcha" and then we can set it global in Joomla instead of set it manually in each of the 100 pages ;-).

We have recently integrated the CAPTCHA function within the Page Builder. Similar to how the Article Addon requires a category selection before displaying articles, the CAPTCHA function also needs to be selected from the CAPTCHA section within the Page Builder.

Pascal Asked this

2 years ago

Hello Toufiq,

for now to prevent the spamming, it is okay :-)!
In the future we need a own JOOMSHAPER CAPTCHA on our server. This would be insane! Thats a big value for us then.

Is it not possible to select a "Default Joomla Captcha" on each page in the SP Page Builder once.
And after it if we change the default Joomla Captcha the SP Page Builder Form_Builder is using it too.
I mean for me its just one new item in the drop down menu ;-). To use the default one or just one of the available once.

Now if the hcaptcha is not good or they turn there services off I need to select again 100 pages per customer and again and again. If I had a option "use the joomla default one" instead, it do it now once and its fine. Then I can change it in one global menu.

Best regards
Pascal

Toufiq Senior Staff

2 years ago

We will consider developing our own reCAPTCHA; however, I cannot confirm it at the moment due to server dependencies. Additionally, I will communicate your other request to our development team and get back to you once I receive their feedback. Thanks for understanding.

Pascal Asked this

2 years ago

Hello Toufiq,

thank you for your time :-)!

For now its fixed and I can work again.
For the future we will see. A own reCAPTCHA, that works on our own webservers would be the best solution at all.

But we need still to fix this bug now that customers can write something in the fields and submit everything without the answered captcha and then all field informations are gone ;-). Otherwise customers will just leave our websites.

Have a nice day!

Best regards
Pascal

Toufiq Senior Staff

2 years ago

I already informed this issue to our team. Allow us time. Thanks

Stuart Clark

2 years ago

Edit: I forgot something. It would be nice too, if we can select the "Default selected Joomla captcha" and then we can set it global in Joomla instead of set it manually in each of the 100 pages ;-).

I think this is the best solution - it allows users to pick whichever Captcha system(s) they have installed in Joomla, and ultimately it will save JoomShaper from having to support multiple Captcha systems.

Toufiq Senior Staff

2 years ago

I appretiate your suggestion. But, Our system doesn't have this function. If you look how the Article Addon requires a category selection before displaying articles, the CAPTCHA function also needs to be selected from the CAPTCHA section within the Page Builder.

Pascal Asked this

2 years ago

Hello Toufiq,

I wanted just to say that I get still a lot of spam over the SP Page Builder Form_Builder contact formular.
I am using hcaptcha everywhere now and somehow I get still the same russian and polish messages.

Very annoying and frustrating. Looks like hcaptcha is allready not be able to protect against all these new AI bots or the captcha is not right implemented and somehow the bots can subtmit messages without using the captcha.

Best regards
Pascal

Yofie Setiawan

2 years ago

Hi Paul,

Maybe you want to try this Aimy Captcha, let me know how do you think...

https://extensions.joomla.org/extension/aimy-captcha-less-form-guard/
https://www.aimy-extensions.com/joomla/captcha-less-form-guard.html

Toufiq Senior Staff

2 years ago

Aim captcha isn't ready for the page builder & Could someone please provide me with a staging site to resolve this issue more quickly? I have checked it on my own server but couldn't identify the problem. I apologize for the inconvenience and need your assistance. I'll aim to have a hotfix ready by tomorrow.

Pascal Asked this

2 years ago

Hello Toufiq,

what I mean is there must be some kind of bypass in the SP Page Builder Form_Builder to send just spam again or it is, because the hcaptcha have the same issues then the Google Invisible reCAPTCHA.

As a human I found no way to just click on the button.

I changed it on 3 websites now and everybody get still spam.

Best regards
Pascal

Toufiq Senior Staff

2 years ago

We trying to figure out the issue. Please allow us time to solve this issue. Thanks

Elliot Block

2 years ago

Definitely seeing the same thing on our website...

Toufiq Senior Staff

2 years ago

Please download this patch & check the issue.

https://drive.google.com/file/d/1b_RpPz06GgS0ijSPnhZcnT8SR-Ky1lvD/view

Pascal Asked this

2 years ago · edited

Hello Toufiq,

thank you for the patch!

I installed it on my website now.

Now it say the captcha is invalid in the case the human did not answer it ;-)! First bug is solved in my opinion.
I cant say something now about the, maybe existing, bypass. Did your team change something in this case? In my opinion a bot is able to bypass it. As a human I was not able to bypass it. But I am not a webdeveloper expert.

Best regards
Pascal

Toufiq Senior Staff

2 years ago

We just checked by bot. But, Bot can't bypass the captcha. Thanks

Pascal Asked this

2 years ago

Hello Toufiq,

we will see. If I will get still spam, then something is wrong ;-)!

In this case I will write again.

Best regards
Pascal

Toufiq Senior Staff

2 years ago

Let me know the update.

Pascal Asked this

2 years ago

Hello Toufiq,

I installed your patch on friday on 3 websites.

What I can say is:
On friday, saturday and sunday I got no single spam email.

I think you guys maybe found the issue in the patch.
(SP Page Builder v.5.3.6 (18) - Captcha-Patch).

Best regards
Pascal

Toufiq Senior Staff

2 years ago

I think we can release it globally. Thanks

Marco M.

2 years ago · edited

Hey Toufiq,

thanks für the update and integration of captcha feature.

I installed com_sppagebuilder_pro_v5.3.7.zip (06 September 2024) and used CK spam protection. Still got a lot of Spam with form_builder addon.

I will try now your Hotfix com_sppagebuilder_pro_v5.3.6 (18).zip.

Were do i have to configure the captcha right? In Joomla main captcha settings is CK Captcha selected. In form_builder settings i can select CK spam protection. Hope this is all right configuered. Form displayes the mathematics. I think it looks good. Thanks.

Update: CK Spam Protection ist not working with you Hotfix It always says "Invalid Recaptcha". hCaptcha seems to work.

Toufiq Senior Staff

2 years ago

CK spam protection is not compatible with the Page Builder.

Steve

2 years ago

Hello Toufiq, I have installed the update 5.3.8. Two minutes later, the SPAM messages immediately reappeared on the customer pages. The problem is NOT solved. The PB-default was set as the captcha.

Pascal Asked this

2 years ago

Hello Steve,

if you mean you are using the 2+3 calculation captcha text fields, thats nothing against these bots.

You need to use hCaptcha and these spamers are gone.

And I am not sure, I used the 5.3.6 (18) patch of the SP Page Builder above from the Google Drive. Maybe this patch is not included in the official versions.

Best regards
Pascal

Toufiq Senior Staff

2 years ago

Could you kindly grant me access to your Joomla administrator area so that I can investigate the issue you're experiencing? Prior to providing access, please ensure that you have backed up your site. Additionally, it's important to note that providing login credentials is entirely voluntary on your part; we respect your decision either way. However, if you do choose to share the login details, it would greatly expedite the resolution process. Thank you for your cooperation.

Steve

2 years ago

Hi Pascal, thanks for the tip. I hope that this will soon come to a good end with a fix.

Unfortunately, I cannot easily rely on hCaptcha, as this requires many points regarding the GDPR. Among other things, it must be explained in the EU

that hCaptcha sets a cookie in your browser,
why they collect user data via hCaptcha,
how long they store the data,
why they pass the data on to hCaptcha,
what legal basis enables them to do so (Art. 6 para. 1 lit. a GDPR)
and that users can object to the collection of data at any time.

The whole thing then via opt-in in the cookie banner and the privacy policy must be adapted. I don't want to explain this to my customer and expect them to do so...

That's why I continue to use the “2+5 calculation” out of necessity.

It would be great and necessary if Joomshaper would allow captchas from any third-party providers, e.g. SecureImage. hCaptcha - that's my opinion - is unfavorable for EU customers of Joomshaper in any case.

Best regards

Toufiq Senior Staff

2 years ago

You can use invisible re-captcha. Thanks

Steve

2 years ago

See hidden Content.

Toufiq Senior Staff

2 years ago

What about hcaptcha?

Steve

2 years ago

It's the same. It comes also from USA. Unfortunately, I cannot easily rely on hCaptcha, as this requires many points regarding the GDPR. Among other things, it must be explained in the EU

that hCaptcha sets a cookie in your browser,
why they collect user data via hCaptcha,
how long they store the data,
why they pass the data on to hCaptcha,
what legal basis enables them to do so (Art. 6 para. 1 lit. a GDPR)
and that users can object to the collection of data at any time.

The whole thing then via opt-in in the cookie banner and the privacy policy must be adapted. I don't want to explain this to my customer and expect them to do so...

That's why I continue to use the “2+5 calculation” out of necessity.

Best regards

Toufiq Senior Staff

2 years ago

We will try to implement the new captcha system. Allow us time. Thanks

Do you have any suggestions?

Toufiq Senior Staff

2 years ago

The hCaptcha is already added compatiblity. Did you try?

Steve

2 years ago

Yes, a secure solution on our own servers

Pascal Asked this

2 years ago

Hello Steve,

this is why I said from the beginning, that we need something without third party servers.
At all without a third party.

A working solution on our own servers is the only right solution.

But you cant use these 2+3 calculation fields.
Any script kidy bot can answer it. It is not a protection at all.

Google is not even useable anymore, because of the low new limits and then we have to pay.

What I see is hCaptcha use technical informations only.
https://www.hcaptcha.com/gdpr

For technical informations we dont need to have any cookie banner at all. Its not about marketing, user tracking etc., ... The EU annoys us anyway with these crap. All websites got now annoying cookie banner. Nobody care, only these law agents they want to let us pay.

Best regards
Pascal

Yofie Setiawan

2 years ago

Anyone find a best solution to this issue? I still receive tons of spam with hcaptcha...

Pascal Asked this

2 years ago

Hello Toufiq,

now I get again tons of russian spam over the form_builder contact formulars with hcaptcha.
It is not that much than before, but it looks like these spam bot scripters are very good.

Dont know. Its very annyoing, but I need this kind of contact option to get in touch with new customers like a lot of my customers too.

Would be nice to get a working solution without a third party and it have to run completly on our servers, because of the GDPR policy in the EU.

GDPR Information

Best regards
Pascal

Toufiq Senior Staff

2 years ago

We will add new captcha system. But, We need time.

Yofie Setiawan

2 years ago

Anyone here can share experience in using Google reCAPTCHA? https://www.google.com/recaptcha/about/

I mean its still free for 10K assessments, would it still be ok?

Pascal Asked this

1 year ago · edited

Hello Toufiq,

my customers and me get still a lot of spam with these hCaptcha.
I get so many emails, phone calls, ... Everybody tell me I have to stop the scam finally. They think the problem was allready solved.

I recommend to implement some kind of antispam system in the SP Page Builder Form Builder.
The system need to watch for defineable "forbidden words" like "viagra" for example.
If the system find words in any field of it the contact formular just have to block these ip adresses.

We need also to be able to edit all these forbidden words. Because the languages of us are different.

In this case we need also a blocklist for Domain-Adresses and IP-Adresses with functions to add and remove. And some kind of whitelist.

And at all we need a own, working Captcha on our servers without any third party.

I was not able to register a other customer of me with the hCaptcha-Website and now I get everytime a error by the registration form of them.

But for now a antispam system with a blacklist, whitelist of e-mail-adresses, domain-adresses, ip-adresses, words would be a good solution anyway. We need to be able to add, remove and edit these things.

Have a nice day!

Best regards
Pascal

Toufiq Senior Staff

1 year ago

Can you provide me your site login credential to check your issue?

Note:

I will set my email address to check the spamming
Also, I will check user registration issue.

Pascal Asked this

1 year ago

Hello Toufiq,

thank you for your answer.

I wrote parallel the problem to your team via email.
They said they will take it serious and implement black- and whitelists.
This is a kind of protection on top and is easy to implement.

We need this, because russian AI bots can solve hCaptcha tasks. At all there are even people they get payed to write scam, spam, advertising emails to us over the contact formulars.

hCaptcha did not answer me. I needed to use a completly different email address, because there system is bugged. Later in the hCaptcha account there is not even a option to change the email address. I hate third party dependencies.

The thing is the most came with the russian language and symbols or from .ru domain addresses. With a blacklist these spam get just blocked before they can send it with the SP Page Builder Form Builder.

At all I have customers they get emails by humans and these humans are sending a lot of emails too over it. But they dont want to get emails of them anymore. These customers got blocked allready in the PBX / phones. In this case its not the allready blocked email address of the "customer". It is your own email address of the contact formular.

There is no antispam proctection implemented for these cases. hCaptcha will block maybe 60-70%. Maybe more if the secure level get higher. But the most people are not able to solve these 2-3 tasks. The hCaptcha is not able to block these spam from real people or AI. But a blacklist / whitelist for words in the fields, domain-adresses, email addresses will do that. Then I can use all letters of the russian alphabet and the spam stopped.

Best regards
Pascal

Toufiq Senior Staff

1 year ago

Hello Pascal,

Thank you for sharing your detailed feedback and concerns.

Can you suggest a CAPTCHA solution that you think will best suit your needs and address these issues effectively?
In the meantime, we have improved the Google Invisible reCAPTCHA in our system, and we highly recommend giving it a try. It might provide a better balance between usability and protection.
I will also share your suggestions regarding the blacklist/whitelist implementation with our development team to explore how we can enhance the SP Page Builder Form Builder further.

Best regards,

Toufiqur Rahman (Team Lead, Support)

Pascal Asked this

1 year ago

Hello Toufiqur Rahman,

my customers are still complaining and forward me everytime these spam emails.

What I noticed is, when I turn the hCaptcha off its 100+ spam emails every day.
If its enabled its like 5-10. But they are still complaining.

The thing is with a blacklist for email adresses, word in the field (message, name, email) we could just stop this. When we block for example the .ru domain or .pl. Because this is the most scam at all in all emails.

The problem is this get send from our email address to us, because they use our contact formulars.

It would be nice to have a own solution of you for a captcha. No third party. And this blacklist / whitelist for all field should get implemented soon as possible. Thats a extra protection against scam / spam.

I have even "bad customers". I blocked them everywhere and then they write everyday to us over our own contact formulars. But we could stop it too with a simple blacklist.

Google is no option at all, because of the last changed and the data protection policy. It is a company from the USA. Then they get access to all information in the fields first. Not good.

Thank you in advance!

Later a happy new year!

King regards
Pascal

Toufiq Senior Staff

1 year ago

We will introduce new function on next release. I hope it will fix the issue. Wait for the next release. Thanks

Pascal Asked this

1 year ago

Hello @Toufiq,

we are 2 months later now again and every day I get very annoying emails of my customer.

They get still a lot of spam every day.

I am using everywhere the hcaptcha. Its everytime spam from poland and russia.
We can block this emails just with a filter - if we had this option. Then we can just block all .pl and .ru domain and its fine. But these functions are still missing.

What is the current process?

This spam problem is now a problem for 1-2 years and it costs me so much time and money and even customers see me now in a bad view, because you guys are not implementing a 100% working solution.

King regards
Pascal

Yofie Setiawan

1 year ago

Hi Pascal,

Have you tried the cloudflare truncation captcha? That seems help on my side..

Pascal Asked this

1 year ago

Hello @Toufiq,

now we are 4 months later, the main problem with the Captcha and spam is maybe 12 months ago and got not really fixed and I get still every day messages of my customers about russian spam.

Every day they get so many russian spam emails. You guys did not even understand that clickfarms or captcha farms are existing even in india or russia. The only solution for these kind of problems are black- and whitelist.

A simple blacklist would stop that. Then I would be able to block of these junk.

It is very annoying. Looks like you guys just ignoring the problem. Your contact formulars are completly useless. Its more like a spam sending machine.

In the past I paid every year 300 euro for a agency plan I dont need. So much money and only problems.
I will stop paying for it and will search for some working solutions.

Best regards
Pascal

Toufiq Senior Staff

1 year ago

Did you try this feature?

https://www.joomshaper.com/documentation/sp-page-builder/configuring-cloudflare-turnstile-captcha

Pascal Asked this

1 year ago

Hello @Toufiq,

its another third party dependency.
We dont have the full control over it - it can be shutdown or it will be another subscription soon.
Joomla just removed the Google Captchas from the core, without any message in advance. There are reasons for it.

It is not helping against real humans in rooms in (click farms), because real humans are writing and spaming.

I just dont want, that people can write with there russian alphabeth in our text fields or from specific domain adresses. That we would get 0 spam at all with the hCaptcha. But the problem are these people. They are not stopping to use our contact formulars to send us spam.

Everyday 1-2 messages of these spamers are enough for my customers to contact me everyday again. Its killing my business. Its not like they send 100-1.000 messages in one day, ... Just the point you cant stop them doing this is frustrating. Only a black- whitelist can help. How I said months ago allready. Cant be that hard with the help of ChatGPT to build a included JoomShaper solution to be honest. Full control in one paid product.

Best regards
Pascal

Toufiq Senior Staff

1 year ago

You can control how much data a user can send within a specific time frame by setting a rate limit.

https://prnt.sc/I5g8UB1exMfr

Pascal Asked this

1 year ago

Hello @Toufiq,

I saw that. But its not helpful for real people spamer that send 1-2 emails per day.
Maybe they even log in with different hotspots and the proctection is not working.

How I said a blacklist would block them 100%. They use evertime the same texts, email adresses or words that can be blocked. Cant belief nobody implemented these kind of basics allready.

That I am sitting hear and hear this shit spam is still there since 12 months is not good for my business. It got reduced, yes, but there is no protection for real people they just fill out the contact forms and solve the captcha with there own hands.

Best regards
Pascal

Steve

1 year ago

Hello Toufiq, hello Ofi, hello Pascal,

it's the same for me. Unfortunately still. And I have also been waiting for a solution for more than 12 months with an agency plan.

My customers receive masses of SPAM messages, so that the form is hidden for most customers. It's hard to explain by now...

Joomshaper, please understand the following points:

Google captcha are not possible in the EU
hCaptcha or Turnstile must be included in the privacy policy for each customer and thus require a lot of effort for my customers and also for me - this is also not possible or cannot be communicated to the customer
the rate limit does not work (see link to post below)

We finally need a solution that allows third-party providers (e.g. SecurImage), our own functioning captcha and/or - as suggested by Pascal - blacklists.

No matter what is done, it is time that this problem is solved. We don't need a new feature like “Dynamic Content” as long as basic things like contact forms don't work. Please focus on this current problem in future releases.

It is also important to know that even the rate limit does not work. In this post (https://www.joomshaper.com/forum/question/38241) there is some exchange with Ofi as well as screenshots from my customers, which prove that despite a rate limit of 4 messages per hour, far more SPAM messages are still being delivered.

In my opinion, captchas and rate limits can therefore still be circumvented. The FormBuilder is, as Pascal quite rightly said, sadly just a “SPAM sending machine”. It is simply unusable in its current version.

Best regards...

Toufiq Senior Staff

1 year ago

Can you share a screencast video about the issue?

Note: If you change your internent then you will get new ip then you can send new mail. But, If you try to send a mail using same ip then you can't sent multiple email (depend on your rate limit settings).

Steve

1 year ago

Hello Toufiq, thank you very much for your reply. I can't send a video of it, but you can have a look at the screenshots under the following post (https://www.joomshaper.com/forum/question/38241#qa-answer-192157) in the hidden content and talk to Ofi. There are too many SPAM messages being sent despite the rate. Thanks for the help in advance and best regards...

Yofie Setiawan

1 year ago

Hi,

I just want to share my experience, the captcha turnstile actually helps from my side. That's why i'm not complaining anymore regarding spam issue. But i agree with Pascal, this solution make us dependent to another 3rd party platform (cloudflare). If we could have independent SPPB self solution for this, that would be great.