Every contact form attracts spam. The usual answer is a CAPTCHA from a large provider. It costs visitors time, often sets cookies and loads scripts from servers abroad – under Georgian law that can be a data transfer that needs a permit (more on that).
We protect our forms differently: with ALTCHA, a proof-of-work method, on our own server.
A computing task instead of a puzzle
When the form loads, the browser receives a small computing task and solves it in the background while the visitor fills in the form. Nobody has to pick traffic lights or type distorted letters. For a single message the effort is negligible; whoever sends thousands of messages pays it thousands of times. Checking a solution costs the server almost nothing.
Our ALTCHA service
We have built a self-hosted service around the open ALTCHA format and published it as open source. It protects any number of websites at once and is managed in a small web interface:
- Signed tasks: every task is signed (HMAC), bound to the site it was issued for and valid exactly once – also across restarts.
- Forms without a backend: the service mails a verified submission to the site’s recipient, so a static website needs no server code of its own.
- Newsletter sign-ups: verified sign-ups go to the newsletter list in Notifuse, which sends the double opt-in mail.
- Your own backend: applications with a backend of their own verify the solution through an interface.
- Protection in layers: rate limits per client and per site, a honeypot field and a strict check of where a request comes from.
- Privacy: no cookies, no state in the browser, no file uploads.
- Operations: statistics in the web interface, Prometheus metrics, a health check and all data in a single SQLite file.
The service also delivers the widget itself – in English or with all of its 68 languages.
Two lines in the page
<script type="module" src="https://altcha.example.com/widget.js"></script>
<form action="https://altcha.example.com/submit" method="post">
<input name="email" type="email" required>
<textarea name="message" required></textarea>
<altcha-widget challenge="https://altcha.example.com/challenge"></altcha-widget>
<button type="submit">Send</button>
</form>There is no build step and no package to install; the same lines work in hand-written HTML, in Astro and in Angular.
In use
The contact forms and newsletter sign-ups on esn.ge, epicsoft.one and our domain sale pages run on this service.
The source code is on GitLab and GitHub, the image on Docker Hub, under the MIT licence. The project is not affiliated with the ALTCHA project; it uses its MIT-licensed widget and library.
We will gladly set it up for your website, too.