Error help us prevent spam by completing the captcha challenge

Make sure you are not blocking Google services  If the reCAPTCHA does not show up and the only thing you see is a "WARNING" box (see below), it is likely that y

Make sure you are not blocking Google services 

If the reCAPTCHA does not show up and the only thing you see is a «WARNING» box (see below), it is likely that your local setup, browser, firewall etc. is blocking Google services. In this case, we recommend trying a different browser, disabling browser plugins that might be interfering, or unblocking Google services manually.

Why am I being presented with a reCAPTCHA challenge?

To protect our website against spam and other automated or malicious activity, we rely on reCAPTCHA — a free service offered by Google that blocks bots, while letting humans through with ease by merely ticking a box.

Note that the vast majority of users will not be presented with the reCAPTCHA challenge in the first place. Only if you happen to raise a flag by e.g. trying to log in repeatedly within a very short time frame, will the reCAPTCHA appear.

This is what the captcha challenge will look like:

To proceed, simply tick the box that says «I’m not a robot» and you’ll be able to move on as normal.

Last updated on November 19, 2019

Exploratory testing of CAPTCHAs

You can reliably test CAPTCHA on review apps, and in your local development environment (GDK). You can always:

  • Force a reCAPTCHA to appear where it is supported.
  • Force a checkbox to display, instead of street sign images to find and select.

To set up testing, follow the configuration on this page.

Use appropriate test data

Make sure you are testing a scenario which has spam/CAPTCHA enabled. For example: make sure you are editing a public snippet, as only public snippets are checked for spam.

Enable feature flags

Enable any relevant feature flag, if the spam/CAPTCHA support is behind a feature flag.

Set up Akismet and reCAPTCHA

  1. To set up reCAPTCHA:
    1. Review the GitLab reCAPTCHA documentation.
    2. Get Google’s official test reCAPTCHA credentials using the instructions from Google’s reCAPTCHA documentation.
      1. For Site key, use: 6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI
      2. For Secret key, use: 6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe
    3. Go to Admin -> Settings -> Reporting settings: http://gdk.test:3000/admin/application_settings/reporting#js-spam-settings
    4. Select Enable reCAPTCHA. Enabling for login is not required unless you are testing that feature.
    5. Enter the Site key and Secret key.
  2. To set up Akismet:
    1. Review the GitLab documentation on Akismet.
    2. Get an Akismet API key. You can sign up for a testing key from Akismet. You must enter your local host (such as gdk.test ) and email when signing up.
    3. Go to GitLab Akismet settings page, for example: http://gdk.test:3000/admin/application_settings/reporting#js-spam-settings
    4. Enable Akismet and enter your Akismet API key.
  3. To force an Akismet false-positive spam check, refer to the Akismet API documentation and Akismet Getting Started documentation for more details:
    1. You can use akismet-guaranteed-spam@example.com as the author email to force spam using the following steps:
      1. Go to user email settings: http://gdk.test:3000/-/profile/emails
      2. Add akismet-guaranteed-spam@example.com as a secondary email for the administrator user.
      3. Confirm it in the Rails console: bin/rails c -> User.find_by_username(‘root’).emails.last.confirm
      4. Switch this verified email to be your primary email:
        1. Go to Avatar dropdown list -> Edit Profile -> Main Settings.
        2. For Email, enter akismet-guaranteed-spam@example.com to replace admin@example.com .
        3. Select Update Profile Settings to save your changes.

Test in the web UI

After you have all the above configuration in place, you can test CAPTCHAs. Test in an area of the application which already has CAPTCHA support, such as:

  • Creating or editing an issue.
  • Creating or editing a public snippet. Only public snippets are checked for spam.

Test in a development environment

After you force Spam Flagging + CAPTCHA using the steps above, you can test the behavior with any spam-protected model/controller action.

Test with CAPTCHA enabled (CONDITIONAL_ALLOW verdict)

If CAPTCHA is enabled in these areas, you must solve the CAPTCHA popup modal before you can resubmit the form:

  • Admin -> Settings -> Reporting -> Spam
  • Anti-bot Protection -> Enable reCAPTCHA

Testing with CAPTCHA disabled («DISALLOW» verdict)

If CAPTCHA is disabled in Admin -> Settings -> Reporting -> Spam and Anti-bot Protection -> Enable reCAPTCHA, no CAPTCHA popup displays. You are prevented from submitting the form at all.

HTML page to render reCAPTCHA

NOTE: If you use Google’s official test reCAPTCHA credentials listed in Set up Akismet and reCAPTCHA, the CAPTCHA response string does not matter. It can be any string. If you use a real, valid key pair, you must solve the CAPTCHA to obtain a valid CAPTCHA response to use. You can do this once only, and only before it expires.

To directly test the GraphQL API via GraphQL Explorer, get a reCAPTCHA response string via this form: public/recaptcha.html ( http://gdk.test:3000/recaptcha.html ):

Spam/CAPTCHA API exploratory testing examples

These sections describe the steps needed to perform manual exploratory testing of various scenarios of the Spam and CAPTCHA behavior for the REST and GraphQL APIs.

For the prerequisites, you must:

  1. Perform all the steps listed above to enable Spam and CAPTCHA in the development environment, and force form submissions to require a CAPTCHA.
  2. Ensure you have created an HTML page to render CAPTCHA under the /public directory, with a page that contains a form to manually generate a valid CAPTCHA response string. If you use Google’s official test reCAPTCHA credentials listed in Set up Akismet and reCAPTCHA, the contents of the CAPTCHA response string don’t matter.
  3. Go to Admin -> Settings -> Reporting -> Spam and Anti-bot protection.
  4. Select or clear Enable reCAPTCHA and Enable Akismet according to your scenario’s needs.

The following examples use snippet creation as an example. You could also use snippet updates, issue creation, or issue updates. Issues and snippets are the only models with full Spam and CAPTCHA support.

Initial setup

  1. Create an API token.
  2. Export it in your terminal for the REST commands: export PRIVATE_TOKEN=
  3. Ensure you are logged into GitLab development environment at localhost:3000 before using GraphiQL explorer, because it uses your logged-in user as authorization for running GraphQL queries.
  4. For the GraphQL examples, use the GraphiQL explorer at http://localhost:3000/-/graphql-explorer .
  5. Use the —include ( -i ) option to curl to print the HTTP response headers, including the status code.

Scenario: Akismet and CAPTCHA enabled

In this example, Akismet and CAPTCHA are enabled:

Initial request

This initial request fails because no CAPTCHA response is provided.

Источник

Prevent spam form submissions

Last updated: November 10, 2022

Applies to:

When a visitor enters their email address into the default email field on a HubSpot form, it is automatically validated by HubSpot. If the email address is not formatted correctly, or if the email has globally bounced, the form cannot be submitted.

You can provide additional protection against spam form submissions by enabling CAPTCHA on your form or blocking specific email domains and free email providers.

Enable CAPTCHA

Enabling CAPTCHA adds a step to your form verifying that a visitor is not a robot, before they can submit the form. To enable CAPTCHA on a form:

  • Lead Capture >Forms.»>» data-sheets-userformat=»<«2″:8402945,»3″:[null,0],»14″:[null,2,0],»15″:»Arial»,»16″:10,»26″:400>» data-sheets-formula=»=»»»>In your HubSpot account, navigate to Marketing >Lead Capture >Forms.
  • Hover over a form and click Edit .
  • In the left pane, under the Other Form Elements section, click to toggle the Captcha (SPAM Prevention) switch on.
  • In the top right, click Update or Publish. After enabling CAPTCHA, Google’s invisible reCAPTCHA will appear on your form when you add the form to a page. If Google determines that a visitor is suspicious, they must solve a CAPTCHA challenge before they can submit the form.

Please note:

  • If your regular form or pop-up form includes a follow-up email, a CAPTCHA will automatically be added to the form. To remove the CAPTCHA from the form, delete the follow-up emails in the Automation tab of the form editor.
  • If CAPTCHA has been enabled on the form, form submissions from the Submit data for a form API or other form integrations will not be accepted.

Block specific email domains or free email providers

If you have a Marketing Hub Starter , Professional , or Enterprise subscription, you can block specific email domains or free email providers to encourage your visitors to provide high-quality business email addresses . These settings are configured on an individual form level and can be used on both forms and pop-up forms.

Источник

CAPTCHA FAQs

To keep customers safe from bad bots when accessing your help center content, Zendesk uses CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart). A CAPTCHA form renders whenever a bot is detected. Learn more about help center spam protection.

CAPTCHA is a Cloudflare rule that uses the Cloudflare Bot management features. The rule prompts requestors for a CAPTCHA if the request matches certain criteria, such as:

  • Having a BotScore that is lower than the threshold
  • Excluding verified bots (such as search crawlers)
  • There being a /hc path for example, which, depending on your settings, might redirect to the sign-in page for:
    • Your login: https://z3ncfblock1.zendesk.com/auth/v2/login/
    • Your sign up: https://z3ncfblock1.zendesk.com/auth/v2/login/registration
    • Ticket submissions: https://z3ncfblock1.zendesk.com/hc/en-us/requests/new

This article covers the following frequently asked questions and scenarios:

Why do I only see CAPTCHA sometimes?

Cloudflare’s Bot Management tool analyzes all Zendesk traffic, and scores it based on how likely it is to come from a human, or a bot. CAPTCHAs appear when traffic is scored within a certain threshold, as it is mostly meant for bots. A bot score of cf.bot_management.verified_bot ), submit a request to Cloudflare.

What does Cloudflare bot management track?

  • Scenario: You are running a good automation or a good bot on the request form, or the anonymous requests API.

Cloudflare bot management does not track traffic on the API. It does track traffic on the form, even though it is not expected that the form has any traffic.

Scenario: You have a custom web form for ticket submission.

Cloudflare bot management tracks the traffic for all custom web forms going through ticket submission.

I have a host mapped account, what should I know?

Cloudflare bot management tracks the traffic for host mapped accounts — this is not an option that you can disable in the CAPTCHA settings.

What is Cloudflare bot management?

Zendesk uses the Cloudflare Bot management feature. It prompts requestors for a CAPTCHA if the request matches certain criteria. For example, if you set a bot score threshold, the feature will prompt a CAPTCHA for all traffic that matches the bot score threshold value (see, What is the difference between the threat score and bot management score?).

A bot score is a value that ranges from 1 (a bot) to 99 (a human). The CAPTCHA page displays a 403 status code if this is triggered.

Something has gone wrong, what do I do?

  • Scenario: Your domain is experiencing issues.

Exclude the domain and inform support.

Scenario: Your monitoring solution is experiencing issues.

Exclude the user agent and inform support

Источник

4 Extensions to Auto Solve and Bypass CAPTCHA in Web Browsers

If you’ve submitted a form or registered for an account on the Internet, you will have stumbled upon a CAPTCHA. There are various types of CAPTCHA including typing in the shown words or numbers, doing some simple maths, solving a visual puzzle, identifying objects, and etc. Basically, the intention of a CAPTCHA is to prevent spam from robots but they also cause inconvenience to real users especially blind and visually impaired people.

Some CAPTCHAs can be very hard to read, even for people with good vision. Other CAPTCHAs can be really annoying to encounter, such as Google’s reCAPTCHA. Not content with you having to solve one visual puzzle, ReCAPTCHA sometimes requires you to solve four or five puzzles in a row. And if you type in the wrong characters or click the wrong button, you have to keep going until you get it right.

Something to help in dealing with a CAPTCHA is using a browser extension that can solve it for you. This can be useful if you can’t see the CAPTCHAs very well, you make a lot of mistakes or you just encounter loads of them all the time. Here we show you some browser extensions and their related CAPTCHA solving services that can help get around the problem.

1. AntiCaptcha

AntiCaptcha is a well known and often recommended CAPTCHA service. It can be slightly confusing though because the main CAPTCHA solving service is hosted at anti-captcha.com while the official browser extension is found at antcpt.com. The extension is available for Chrome and Firefox and associated browsers that support those extensions. AntiCaptcha is a paid service and requires payment into your account to spend on solving each CAPTCHA.

First, you’ll need to signup for an AntiCaptcha account and then add some funds. You can pretty much pay as much or as little as you like, around $1 will get you 1,000 CAPTCHA or 500 ReCAPTCHA solves. Prices do fluctuate during the day so you may be charged more per solve at peak times. Chrome users can get 15 trial credits by installing the extension and authorizing it with a Google account.

Next, download and install the AntiCaptcha extension from antcpt.com. The extensions are not available on the Chrome or Firefox web stores and have to be installed manually. Detailed instructions are provided on the download page. Once installed, copy the key from your account (Settings > API Setup), click on the new AntiCaptcha icon found in the browser toolbar, paste the key into the box and click Save. Within a second or two, it should show your AntiCaptcha account balance.

AntiCaptcha can solve most types of CAPTCHA including Google ReCAPTCHA, FunCaptcha, Geetest, Solve Media, and standard image CAPTCHAs. The first three we mention can be solved automatically when you load a page containing one of those CAPTCHAs. The other regular types require you to right click on the answer input box and select “Find and solve CAPTCHA image for this input” or press Ctrl+Shift+6.

The average image CAPTCHA solve speed is reasonable and usually takes 5-20 seconds. ReCaptcha solving sometimes takes a while and it can be 30-60 seconds quite often. The caching setting in the extension can help although it eats up your credit a bit faster. AntiCaptcha is perhaps the only service available that has its own browser extensions, handles most common CAPTCHA types and can get you started with minimal outlay. Competing services can require adding funds of at least $10.

2. Buster: Captcha Solver for Humans

Buster has perhaps a unique place in the captcha solving market because it is open source, free to use and requires no subscriptions. It works by using speech recognition to try and solve the voice challenge in the CAPTCHA. The drawback is this extension only works for Google’s ReCAPTCHA but that’s probably the most common form of CAPTCHA around today. There are extensions available for Chrome, Firefox, and Opera.

At the time or writing, Buster is not working properly in Firefox (currently v69). It will often show the error “Cannot contact reCAPTCHA. Check your connection and try again.” after trying to solve. We’ve traced this error back and found it started appearing in Firefox 65. Using Firefox 64 or below should get around this issue before it hopefully gets fixed. The Buster extension for Chrome seems to have no such problems and during testing, it worked well.

After installing the extension, Buster Captcha Solver is very easy to use and only requires a couple of mouse clicks to start solving a ReCAPTCHA. Once you encounter a ReCAPTCHA, click “I’m not a robot” to open the challenge window. An orange and green icon appears at the bottom, click on it and the voice challenge window will open and Buster will begin solving the CAPTCHA. Solving is actually pretty fast and is usually done in under 30 seconds, much faster than the paid AntiCaptcha.

While it’s working you will see an animated circular icon in the window. If Buster solves the challenge it will successfully complete the ReCAPTCHA. If it fails or there is any sort of error, just press the far left button to get a new challenge and try again. In our experience, Buster solves the challenge the first time in roughly three out of every four attempts. If it fails the first time, it nearly always works on the second try.

3. Rumola

Rumola has been around for quite a long time and is probably one of the longest running services of its type. The Rumola browser extension used to be available for Firefox, Chrome and Safari browser but sadly the Firefox and Safari versions have disappeared. There is a Javascript based bookmarklet that can work for virtually any device connected to the Internet. It’s very limited but gets the service working on other browsers that can’t use Chrome extensions.

Rumola works for a CAPTCHA where you have to type in the shown words, numbers, characters or solve a maths puzzle. It does not work on Google ReCAPTCHA or the type of CAPTCHA where you have to select, reorder or rotate images. By default, Rumola will automatically search for CAPTCHAs on visited web pages although the option can be turned off from the extension menu on the Chrome toolbar.

If Rumola detects a CAPTCHA on the page it will overlay a small icon on the image and the answer text box. Simply double click inside the empty answer text box and Rumola will animate the icons while solving is in progress. Alternatively, start typing in any other text box on the page. If the CAPTCHA has not been detected you can try “Search for CAPTCHAs on this page” from the extension menu.

In the event nothing is detected after searching the page, right click on the CAPTCHA image and select “Recognise this image as CAPTCHA”. If the little icon is not animating, right click on the answer text box as well and select “Use this field to enter CAPTCHA”. A combination of one or both of those options should get the CAPTCHA detected and solved. Rumola is usually pretty fast and often takes only 5-10 seconds to solve a CAPTCHA.

Installing Rumola the first time will give you 5 free credits for testing. The free credits are unreliable though and you’ll sometimes lose all of them for doing something simple like just trying to detect a CAPTCHA on the page. The price is $0.99 for 50 credits valid for 1 year or $1.95 for 150 credits valid for six months. That’s very expensive compared to other services so Rumola is probably better suited for users that need to solve the occasional CAPTCHA now and again.

4. ReCaptcha Solver

ReCaptcha Solver is a third party extension that has no ties to a specific CAPTCHA solving company. Instead, you can use one of a number of different services where you may have a paid subscription. As the name implies, only Google ReCAPTCHA v2 is supported which makes it very similar to Buster: Captcha Solver for Humans.

Before using ReCaptcha Solver, you need to have signed up and purchased credit with DeathByCaptcha, 2captcha, ImageTyperz, Anti-Captcha, BestCaptchaSolver, or EndCaptcha. Then you can select your CAPTCHA service from the drop down, enter its API key or username/password and start using the extension to solve ReCAPTCHAs.

We did try this extension with AntiCaptcha and EndCaptcha and it worked as intended. However, we can’t vouch for how well it works with the other supported CAPTCHA solving services. Speed will obviously depend on the service itself and how fast it solves ReCAPTCHA. Although we’d recommend trying Buster first if you can, this is worth a go if you already have or plan to get some credit from one of the supported services.

Final Note: The best option is probably using a combination of Buster for solving ReCAPTCHAs and AntiCaptcha to solve the rest. ReCAPTCHA is the most common type of CAPTCHA and more expensive to solve with AntiCaptcha, so using Buster means ReCAPTCHAs will be solved faster and your AntiCaptcha credit will last longer for everything else.

Источник

DISCLAIMER: I own SpamCaptcher but will still try to be impartial here

The results you will see with your CAPTCHA depend heavily on 3 main factors:

  1. How you implemented the CAPTCHA
  2. The type of CAPTCHA you use
  3. The return on investment a spammer gets from spamming your site

CAPTCHA Implementation

Before we discuss whether the type of CAPTCHA you are using is the right one for your needs (or whether you should be using one at all), first check to see if it is implemented correctly. If it isn’t being validated server side, can be bypassed by turning off JavaScript or disabling Flash (or changing any other client-side configuration), or the answer is stored client-side then the implementation needs to be fixed. Of course, whoever makes the CAPTCHA you use should make it so you don’t have to worry about this. Note: I highly recommend against you rolling your own CAPTCHA solution.

CAPTCHA Type

Most people think of CAPTCHAs as a picture of distorted text that they have to decipher. While this is certainly one implementation of a CAPTCHA (and currently the most «popular») it is not the only one. While this distorted text based CAPTCHA was successful for a little while, the improvement of OCR made it so that spammers could solve these with automated tools. In an effort to combat this, the people who made the CAPTCHAs made them harder to read and now we are stuck in a situation where computers keep getting better at solving them while humans struggle more and more. Recently there has been a boom in CAPTCHA providers providing a range of different types of CAPTCHAs:

  • Image recognition
  • Image orientation (my personal favorite)
  • Games
  • Video comprehension
  • Audio comprehension
  • etc.

Also, people have moved away from the strict definition of a CAPTCHA and have come up with some other solutions that may work for you depending on your site (more about this in the next section).

Some things to keep in mind when you are selecting a CAPTCHA type is that certain people may struggle with certain types. It is good practice to make sure that people with visual impairments and people with hearing impairments can still solve the CAPTCHA. It is also important to note that the CAPTCHA is only as strong as its weakest point. So, for example, if the visual portion of a CAPTCHA were rock solid but the audio component was weak, then security would be weak. In fact, in this case you would only be bothering most of your legitimate users with the CAPTCHA while providing the spammers an easy way to get around it it.

Spam ROI

Depending on the nature of your site, spammers may have a big or small incentive to spam you. If the incentive is small then chances are that they will not write custom solutions to spam you. However, if the incentive is big then there is a good chance that they will write custom solutions for your site.

Let’s start with the small incentive case. If you fall into this category then I recommend picking a CAPTCHA that doesn’t have widespread adoption yet (but is still secure) and is extremely easy, if not transparent, for your users. Honeypots and Hashcash are examples of transparent solutions. At SpamCaptcher we provide such a solution called Proof-of-Work.

If, on the other hand, you have a site that has a high ROI for the spammers then you will need more security. In this case you obviously want to pick a solution that has strong security and still provides a good user experience. However, if the ROI of your site is high enough then you may be faced with Human CAPTCHA Solvers. A CAPTCHA alone will not protect you from them. However, (another shameless plug), SpamCaptcher has its TrustMe Account solution for that.

Conclusion

You really need to pick the CAPTCHA that is right for your needs which means you need to find the right balance between security and user friendliness. I obviously recommend SpamCaptcher and think our Rotational Image CAPTCHA would be a great solution for you but you obviously need to decide what is best for your site. Here are a couple CAPTCHA providers you may want to consider:

  • SpamCaptcher
  • Confident Technologies
  • ReCaptcha

Hope that helps!

About reCAPTCHA

  1. What is reCAPTCHA?

Using reCAPTCHA V2

  1. How do I use reCAPTCHA?
  2. Accessibility
  3. This CAPTCHA is too hard
  4. My computer is sending automated queries

Help for reCAPTCHA users

  1. Browser requirements for reCAPTCHA
  2. Not seeing the checkbox and want an easier challenge?

Help for website owners

  1. How can I integrate reCAPTCHA in my site?
  2. FAQs

About reCAPTCHA

  1. What is reCAPTCHA?

    reCAPTCHA is a free service from Google that helps protect websites from spam and abuse. A “CAPTCHA” is a turing test to tell human and bots apart. It is easy for humans to solve, but hard for “bots” and other malicious software to figure out. By adding reCAPTCHA to a site, you can block automated software while helping your welcome users to enter with ease. Try it out at https://www.google.com/recaptcha/api2/demo.

    To learn more about reCAPTCHA, visit our official website or our technical documentation site.

Using reCAPTCHA V2

  1. How do I use reCAPTCHA?

    Just click the checkbox:

    animated reCAPTCHA checkbox widget

    If you see a green checkmark, congratulations! You’ve passed our robot test (yes, it’s that easy). You can carry on with what you were doing.

    Sometimes we need some extra info from you to make sure you’re human and not a robot, so we ask you to solve a challenge:

    CAPTCHA challenge

    Simply follow the on-screen instructions to solve the puzzle and then carry on with your task.

  2. Accessibility

    reCAPTCHA works with major screen readers such as ChromeVox (Chrome OS), JAWS (IE/Edge/Chrome on Windows), NVDA (IE/Edge/Chrome on Windows) and VoiceOver (Safari/Chrome on Mac OS). reCAPTCHA will alert screen readers of status changes, such as when the reCAPTCHA verification challenge is complete. The status can also be found by looking for the heading titled “recaptcha status” in the “recaptcha widget” section of the page. See reCAPTCHA ARIA Status Messages for more information.

    Please use the following steps to solve an audio challenge:

    1. If you are presented with a visual challenge, locate and click on the Get an audio challenge button.

    2. You will be presented with one of two versions of the audio challenge depending on whether you’re using a mobile device.
      audio challenge with the focus set on the PLAY buttonmobile audio challenge with the focus set on the audio controls

    3. Press PLAY and enter the numbers you hear in the text input box located after the PLAY button or audio control. If your focus isn’t automatically set on the text input box after pressing the PLAY button, tab to proceed to it. When you’re done entering the numbers from the audio, press ENTER or click on the “Verify” button to submit your answer.

    4. If your answer is incorrect, you will be presented with another audio challenge.

      audio challenge after a failed attempt, the focus is set on the error messagemobile audio challenge after a failed attempt, the focus is set on the error message

    5. If your answer is correct, the audio challenge will close and the reCAPTCHA checkbox will become checked. ReCAPTCHA will also notify the screen reader of the successful verification.

      reCAPTCHA checkbox checked after successfully completing a verification challenge

      Please note that the verification will expire after some time and you will need to start over if this occurs. You will be notified if the verification expires. 

      reCAPTCHA checkbox unchecked after the verification expires

    ​Tips

    • If the audio doesn’t play, try downloading the audio by locating and clicking on the Alternatively, download audio as MP3 link.

    • While in the text input box, you can press the “R” button to replay the audio from the beginning

    • To get a different audio challenge, locate and press the Get a new challengebutton.

    • The reCAPTCHA verification expires after a certain amount of time so it is best to complete the reCAPTCHA verification last on a website you are accessing.

    • Some screen readers may have difficulties getting into forms mode, if this happens, please use your screen reader’s functionality to force forms mode.

    reCAPTCHA ARIA Status Messages

    Status message

    Detailed description

    Recaptcha requires verification

    The initial state, reCAPTCHA verification is required to proceed on this website. Click the checkbox to get a verification challenge.

    Opening verification challenge

    The checkbox has been clicked and a challenge is loading. You are instantly verified if the status changes to “You are verified”. Otherwise, you are required to complete a verification challenge.

    Verification challenge expired, check the checkbox again for a new challenge

    The verification challenge expired due to timeout or inactivity. Click the checkbox again for a new challenge.

    You are verified

    You have been verified. You can now proceed on the website.

    Verification expired, check the checkbox again for a new challenge

    The verification expired due to timeout or inactivity. Click the checkbox again for a new challenge.

  3. This CAPTCHA is too hard

    Don’t worry. Some CAPTCHAs are hard. Just click the reload button next to the image to get another one.

  4. My computer is sending automated queries

    Our unusual traffic help page describes what to do if you see this message:

    «We’re sorry, but your computer or network may be sending automated queries. To protect our users, we can’t process your request right now.»

Help for reCAPTCHA users

  1. Browser requirements for reCAPTCHA

    We support the two most recent major versions of the following:

    • desktop (Windows, Linux, Mac)
      • Chrome
      • Firefox
      • Safari
      • Chromium Edge
      • IE until 2022 June 15
    • mobile
      • Chrome
      • Safari
      • Android native browser
  2. Not seeing the checkbox and want an easier challenge?

    If you’re seeing this reCAPTCHA challenge, your browser environment doesn’t support the reCAPTCHA checkbox widget.

    There are a few steps you can take to improve your experience:

    • Make sure your browser is fully updated (see minimum browser requirements)
    • Check that JavaScript is enabled in your browser
    • Try disabling plugins that might conflict with reCAPTCHA

    Please note that some sites may have incorrectly integrated with reCAPTCHA — in this case please contact the site’s webmaster.

Help for website owners

  1. How can I integrate reCAPTCHA in my site?

    Using reCAPTCHA in your site is very easy. First, register your site here and then follow the short on-screen instructions.

  2. FAQs

    If you are having any technical problems in your site, please refer to our Frequently Asked Questions. If you don’t see your problem listed there, try our support forum.

If you are experiencing a lot of spam coming through your web forms you can use Google reCaptcha to prevent bots from spamming your forms.

How to Setup Google reCaptcha

1. Get your reCaptcha keys

Create reCaptcha keys in the Google reCaptcha console.

2. Set Up Your Keys in Groundhogg

Copy and paste your keys into the relevant fields in the Groundhogg settings page. Go to Admin > Groundhogg > Misc.

3. Choose Your reCaptcha Settings

In Groundhogg there are a number of settings related to reCaptcha that you can set.

Let’s start with which reCaptcha version should you go with? At the time of writing there are two reCaptcha versions, v2 and v3. 

v2 has a familiar to many «I’m not a robot» challenge, which requires the person to click a checkbox that checks if they are a robot or not. Which will either pass the person right away or challenge them to complete a captcha.

v2 also has the invisible badge which will check to see if the person is robot only when the submit button is clicked. Only the visitors who are the most suspicious will be required to complete a captcha.

v3 doesn’t require the suspicious people to complete any sort of captcha as it verify’s if an interaction is legitimate (or not). It returns a score which you can change in Groundhogg.

Using v3? What’s the score threshold you want?

v3 of reCaptcha returns a score between 0.0 and 1.0, and by default Groundhogg only actually submits the form if the score is higher than 0.5.

You may be wondering what score you should set, we advise you stay with 0.5 to start and if your potential customers are complaining about not being able to submit the form then lower the score. 

It may require some changing but once you get the right score, or choose the right reCaptcha for you then it will result in less spam.

Make sure to hit Save Changes at bottom of the page before moving onto the next step.

4. Add reCaptcha to Your Form

Add the reCaptcha field to your form in the form builder.

Did this answer your question?


Thanks for the feedback

There was a problem submitting your feedback. Please try again later.

Содержание

  • Что такое reCAPTCHA
  • Почему в браузере не работает reCAPTCHA
    • Мы просматриваем через VPN или прокси
    • Браузер устарел
    • Вредоносное ПО в системе
    • Мы подключены с подозрительного IP
  • Что делать для устранения неполадок с reCAPTCHA
    • Держите оборудование в безопасности
    • Обновите систему и браузер
    • Контроль использования VPN и прокси
    • Перезагрузите IP
    • Перезагрузите роутер

Во многих случаях при доступе к веб-странице появляется сообщение убедитесь, что мы настоящий пользователь а не бот. Это позволяет предлагать правильные услуги без ущерба для самого веб-сайта или любого пользователя.

Ошибка ReCAPTCHA

В основном это то, что делает reCAPTCHA. Это бесплатная служба Google, которая проверяет, что вход на страницу или платформу осуществляется человеком, а не ботом. Он помогает этим сайтам избежать ввода различных автоматизированных инструментов, которые могут даже привести к рассылка спама и угроз .

Использование пользователями очень простое. Интернет-пользователь входит на страницу, и появляется поле, в котором он должен отметить, что он не бот, и тем самым подтвердить, что он человек. Это похоже на другие варианты, которые мы видим, в которых вы должны отметить серию цифр, изображений и т. Д. Однако в этом случае процесс выполняется быстрее и проще.

Однако бывают случаи, когда появляется ошибка и reCAPTCHA не работает в Chrome или любом браузере. Появится сообщение о том, что проверка не удалась. Это помешает нам открыть веб-сайт или войти в систему.

Почему в браузере не работает reCAPTCHA

Важно знать основные причины, по которым reCAPTCHA вылетает в браузере. Нет конкретной причины, но есть ряд возможностей, которые необходимо принять во внимание, а затем решить эту проблему для правильной навигации.

Мы просматриваем через VPN или прокси

Иметь VPN или просматривая полномочие очень распространено. В нашем распоряжении много таких услуг. Они позволяют нам избегать возможных географических блоков, которые могут существовать, а также сохранять личную информацию, если мы подключаемся из общедоступной сети.

Однако это может быть причиной того, что reCAPTCHA не работает в браузере. Это может привести к конфликту с сетью и лишить нас возможности проверить, действительно ли мы являемся законным пользователем, а не ботом.

Браузер устарел

Эта ошибка возникает в браузере, поэтому одна из причин, которая также может вызывать эту проблему, заключается в том, что он не обновлен. Имея устаревшее программное обеспечение может быть источником множества ошибок при подключении к сети и использовании наших устройств.

Вредоносное ПО в системе

Конечно, может случиться так, что у нас есть какое-то вредоносное ПО. Особенно это может быть рекламное ПО в браузере, хотя это может быть троян, вирус или любой другой угроза в системе .

Мы уже знаем, что хакеры используют множество стратегий, чтобы подвергнуть риску наши компьютеры. Многие атаки могут повлиять на правильное функционирование браузера и привести к сбоям, подобным тому, что мы описываем в этой статье.

Мы подключены с подозрительного IP

В таких случаях это очень частая причина. Веб-сайт интерпретирует, что мы подключены к подозрительный IP и считает, что мы можем быть ботом. Это может произойти, если мы просматриваем общедоступный Wi-Fi, например, где внутри много пользователей. Также в случае доступа к сети из VPN.

Что делать для устранения неполадок с reCAPTCHA

Мы увидели, каковы основные причины появления ошибки reCAPTCHA в браузере. Теперь мы собираемся объяснить некоторые проблемы, которые необходимо принять во внимание, чтобы это не превратилось в проблему и чтобы иметь возможность нормально перемещаться.

Держите оборудование в безопасности

Конечно, один из самых важных вопросов избежать сбоя reCAPTCHA и другие подобные сообщения, которые могут появиться в браузере, предназначены для обеспечения безопасности компьютера. Для этого мы можем использовать множество инструментов, доступных для всех типов операционных систем.

Мы можем использовать антивирус, а также брандмауэр и даже расширения для браузера. Все это поможет нам избежать проникновения вредоносных программ, которые могут повлиять на нас. Мы должны поддерживать безопасность на всех уровнях и, таким образом, уменьшать проблемы.

Обновите систему и браузер

Один момент, который мы не можем забыть, — это постоянно обновлять как систему, так и браузер. Во многих случаях появляются уязвимости и сбои, которые могут вызывать эти типы ошибок, а также служить шлюзом для хакеров.

Это означает, что у нас всегда должны быть все патчи и обновления которые доступны. Но особенно вы должны принять во внимание важность наличия последней версии браузера, чтобы предотвратить его устаревание и появление ошибок такого типа.

Контроль использования VPN и прокси

Если мы собираемся перемещаться через VPN или прокси и замечаем, что это может создавать проблемы такого типа, мы должны контролировать использование. Мы можем взглянуть на конфигурацию, посмотреть, может ли это быть ошибка с сервера мы подключены и в конечном итоге пытаемся использовать другой сервис.

Перезагрузите IP

In Windows мы можем легко сбросить IP из командной строки. Для этого нам нужно перейти в Пуск, получить доступ к командной строке в режиме администратора и выполнить ipconfig / обновить . Это могло бы помочь исправить этот сбой, если это было причиной.

Reiniciar la IP

Перезагрузите роутер

Мы видели, что могут быть проблемы и с нашим IP. Но сам маршрутизатор мог неправильно обрабатывать запросы. Поэтому важный совет — перезагрузите устройство и посмотрите, устранит ли это неисправность. Теперь вам нужно сделать это правильно. Мы должны выключить роутер и позволить ему оставаться в таком состоянии не менее 30 секунд, прежде чем снова его включить.

Таким образом, это некоторые из основных проблем, которые мы должны учитывать, чтобы избежать проблемы reCAPTCHA в браузере. Мы рассмотрели основные причины возникновения подобных сбоев, а также несколько основных советов по их устранению.

Exploratory testing of CAPTCHAs

You can reliably test CAPTCHA on review apps, and in your local development environment (GDK).
You can always:

  • Force a reCAPTCHA to appear where it is supported.
  • Force a checkbox to display, instead of street sign images to find and select.

To set up testing, follow the configuration on this page.

Use appropriate test data

Make sure you are testing a scenario which has spam/CAPTCHA enabled. For example:
make sure you are editing a public snippet, as only public snippets are checked for spam.

Enable feature flags

Enable any relevant feature flag, if the spam/CAPTCHA support is behind a feature flag.

Set up Akismet and reCAPTCHA

  1. To set up reCAPTCHA:
    1. Review the GitLab reCAPTCHA documentation.
    2. Get Google’s official test reCAPTCHA credentials using the instructions from
      Google’s reCAPTCHA documentation.

      1. For Site key, use: 6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI
      2. For Secret key, use: 6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe
    3. Go to Admin -> Settings -> Reporting settings: http://gdk.test:3000/admin/application_settings/reporting#js-spam-settings
    4. Select Enable reCAPTCHA. Enabling for login is not required unless you are testing that feature.
    5. Enter the Site key and Secret key.
  2. To set up Akismet:
    1. Review the GitLab documentation on Akismet.
    2. Get an Akismet API key. You can sign up for a testing key from Akismet.
      You must enter your local host (such asgdk.test) and email when signing up.
    3. Go to GitLab Akismet settings page, for example:
      http://gdk.test:3000/admin/application_settings/reporting#js-spam-settings
    4. Enable Akismet and enter your Akismet API key.
  3. To force an Akismet false-positive spam check, refer to the
    Akismet API documentation and
    Akismet Getting Started documentation for more details:

    1. You can use akismet-guaranteed-spam@example.com as the author email to force spam using the following steps:
      1. Go to user email settings: http://gdk.test:3000/-/profile/emails
      2. Add akismet-guaranteed-spam@example.com as a secondary email for the administrator user.
      3. Confirm it in the Rails console: bin/rails c -> User.find_by_username('root').emails.last.confirm
      4. Switch this verified email to be your primary email:
        1. Go to Avatar dropdown list -> Edit Profile -> Main Settings.
        2. For Email, enter akismet-guaranteed-spam@example.com to replace admin@example.com.
        3. Select Update Profile Settings to save your changes.

Test in the web UI

After you have all the above configuration in place, you can test CAPTCHAs. Test
in an area of the application which already has CAPTCHA support, such as:

  • Creating or editing an issue.
  • Creating or editing a public snippet. Only public snippets are checked for spam.

Test in a development environment

After you force Spam Flagging + CAPTCHA using the steps above, you can test the
behavior with any spam-protected model/controller action.

Test with CAPTCHA enabled (CONDITIONAL_ALLOW verdict)

If CAPTCHA is enabled in these areas, you must solve the CAPTCHA popup modal before you can resubmit the form:

  • Admin -> Settings -> Reporting -> Spam
  • Anti-bot Protection -> Enable reCAPTCHA

Testing with CAPTCHA disabled («DISALLOW» verdict)

If CAPTCHA is disabled in Admin -> Settings -> Reporting -> Spam and Anti-bot Protection -> Enable reCAPTCHA,
no CAPTCHA popup displays. You are prevented from submitting the form at all.

HTML page to render reCAPTCHA

NOTE:
If you use Google’s official test reCAPTCHA credentials listed in
Set up Akismet and reCAPTCHA, the
CAPTCHA response string does not matter. It can be any string. If you use a
real, valid key pair, you must solve the CAPTCHA to obtain a
valid CAPTCHA response to use. You can do this once only, and only before it expires.

To directly test the GraphQL API via GraphQL Explorer (http://gdk.test:3000/-/graphql-explorer),
get a reCAPTCHA response string via this form: public/recaptcha.html (http://gdk.test:3000/recaptcha.html):

<html>
<head>
  <title>reCAPTCHA demo: Explicit render after an onload callback</title>
  <script type="text/javascript">
  var onloadCallback = function() {
    grecaptcha.render('html_element', {
      'sitekey' : '6Ld05AsaAAAAAMsm1yTUp4qsdFARN15rQJPPqv6i'
    });
  };
  function onSubmit() {
    window.document.getElementById('recaptchaResponse').innerHTML = grecaptcha.getResponse();
    return false;
  }
  </script>
</head>
<body>
<form onsubmit="return onSubmit()">
  <div id="html_element"></div>
  <br>
  <input type="submit" value="Submit">
</form>
<div>
  <h1>recaptchaResponse:</h1>
  <div id="recaptchaResponse"></div>
</div>
<script src="https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=explicit"
        async defer>
</script>
</body>
</html>

Spam/CAPTCHA API exploratory testing examples

These sections describe the steps needed to perform manual exploratory testing of
various scenarios of the Spam and CAPTCHA behavior for the REST and GraphQL APIs.

For the prerequisites, you must:

  1. Perform all the steps listed above to enable Spam and CAPTCHA in the development environment,
    and force form submissions to require a CAPTCHA.
  2. Ensure you have created an HTML page to render CAPTCHA under the /public directory,
    with a page that contains a form to manually generate a valid CAPTCHA response string.
    If you use Google’s official test reCAPTCHA credentials listed in
    Set up Akismet and reCAPTCHA, the contents of the
    CAPTCHA response string don’t matter.
  3. Go to Admin -> Settings -> Reporting -> Spam and Anti-bot protection.
  4. Select or clear Enable reCAPTCHA and Enable Akismet according to your
    scenario’s needs.

The following examples use snippet creation as an example. You could also use
snippet updates, issue creation, or issue updates. Issues and snippets are the
only models with full Spam and CAPTCHA support.

Initial setup

  1. Create an API token.
  2. Export it in your terminal for the REST commands: export PRIVATE_TOKEN=<your_api_token>
  3. Ensure you are signed into the GitLab development environment at localhost:3000 before using GraphiQL explorer,
    because it uses your authenticated user as authorization for running GraphQL queries.
  4. For the GraphQL examples, use the GraphiQL explorer at http://localhost:3000/-/graphql-explorer.
  5. Use the --include (-i) option to curl to print the HTTP response headers, including the status code.

Scenario: Akismet and CAPTCHA enabled

In this example, Akismet and CAPTCHA are enabled:

  1. Initial request.

Initial request

This initial request fails because no CAPTCHA response is provided.

REST request:

curl --request POST --header "PRIVATE-TOKEN: $PRIVATE_TOKEN" "http://localhost:3000/api/v4/snippets?title=Title&file_name=FileName&content=Content&visibility=public"

REST response:

{"needs_captcha_response":true,"spam_log_id":42,"captcha_site_key":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","message":{"error":"Your snippet has been recognized as spam. Please, change the content or solve the reCAPTCHA to proceed."}}

GraphQL request:

mutation {
    createSnippet(input: {
        title: "Title"
        visibilityLevel: public
        blobActions: [
            {
                action: create
                filePath: "BlobPath"
                content: "BlobContent"
            }
        ]
    }) {
        snippet {
            id
            title
        }
        errors
    }
}

GraphQL response:

{
  "data": {
    "createSnippet": null
  },
  "errors": [
    {
      "message": "Request denied. Solve CAPTCHA challenge and retry",
      "locations": [
        {
          "line": 22,
          "column": 5
        }
      ],
      "path": [
        "createSnippet"
      ],
      "extensions": {
        "needs_captcha_response": true,
        "spam_log_id": 140,
        "captcha_site_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
      }
    }
  ]
}

Second request

This request succeeds because a CAPTCHA response is provided.

REST request:

export CAPTCHA_RESPONSE="<CAPTCHA response obtained from HTML page to render CAPTCHA>"
export SPAM_LOG_ID="<spam_log_id obtained from initial REST response>"
curl --request POST --header "PRIVATE-TOKEN: $PRIVATE_TOKEN" --header "X-GitLab-Captcha-Response: $CAPTCHA_RESPONSE" --header "X-GitLab-Spam-Log-Id: $SPAM_LOG_ID" "http://localhost:3000/api/v4/snippets?title=Title&file_name=FileName&content=Content&visibility=public"

REST response:

{"id":42,"title":"Title","description":null,"visibility":"public", "other_fields": "..."}

GraphQL request:

NOTE:
The GitLab GraphiQL implementation doesn’t allow passing of headers, so we must write
this as a curl query. Here, --data-binary is used to properly handle escaped double quotes
in the JSON-embedded query.

export CAPTCHA_RESPONSE="<CAPTCHA response obtained from HTML page to render CAPTCHA>"
export SPAM_LOG_ID="<spam_log_id obtained from initial REST response>"
curl --include "http://localhost:3000/api/graphql" --header "Authorization: Bearer $PRIVATE_TOKEN" --header "Content-Type: application/json" --header "X-GitLab-Captcha-Response: $CAPTCHA_RESPONSE" --header "X-GitLab-Spam-Log-Id: $SPAM_LOG_ID" --request POST --data-binary '{"query": "mutation {createSnippet(input: {title: "Title" visibilityLevel: public blobActions: [ { action: create filePath: "BlobPath" content: "BlobContent" } ] }) { snippet { id title } errors }}"}'

GraphQL response:

{"data":{"createSnippet":{"snippet":{"id":"gid://gitlab/PersonalSnippet/42","title":"Title"},"errors":[]}}}

Scenario: Akismet enabled, CAPTCHA disabled

For this scenario, ensure you clear Enable reCAPTCHA in the Admin Area settings as described above.
If CAPTCHA is not enabled, any request flagged as potential spam fails with no chance to resubmit,
even if it could otherwise be resubmitted if CAPTCHA were enabled and successfully solved.

The REST request is the same as if CAPTCHA was enabled:

curl --request POST --header "PRIVATE-TOKEN: $PRIVATE_TOKEN" "http://localhost:3000/api/v4/snippets?title=Title&file_name=FileName&content=Content&visibility=public"

REST response:

{"message":{"error":"Your snippet has been recognized as spam and has been discarded."}}

GraphQL request:

mutation {
    createSnippet(input: {
        title: "Title"
        visibilityLevel: public
        blobActions: [
            {
                action: create
                filePath: "BlobPath"
                content: "BlobContent"
            }
        ]
    }) {
        snippet {
            id
            title
        }
        errors
    }
}

GraphQL response:

{
  "data": {
    "createSnippet": null
  },
  "errors": [
    {
      "message": "Request denied. Spam detected",
      "locations": [
        {
          "line": 22,
          "column": 5
        }
      ],
      "path": [
        "createSnippet"
      ],
      "extensions": {
        "spam": true
      }
    }
  ]
}

Scenario: allow_possible_spam feature flag enabled

With the allow_possible_spam feature flag enabled, the API returns a 200 response. Any
valid request is successful and no CAPTCHA is presented, even if the request is considered
spam.

Понравилась статья? Поделить с друзьями:
  • Error helm upgrade requires 2 arguments
  • Error heater автономка скания не запускается
  • Error header что значит
  • Error header как переводится
  • Error header name must be a valid http token