Download the PHP package tito10047/altcha-bundle without Composer

A simple package to help integrate ALTCHA on Symfony Form.

This packages integrates ALTCHA, a privacy-friendly Captcha alternative, with Symfony forms. Simply add an AltchaType field to your form and this package will automatically check the challenge issue.

ALTCHA uses a proof-of-work mechanism to protect your website, APIs, and online services from spam and unwanted content.

Unlike other solutions, ALTCHA is free, open-source and self-hosted, does not use cookies nor fingerprinting, does not track users, and is fully compliant with GDPR.

Say goodbye to tedious puzzle-solving and improve your website's UX by integrating a fully automated proof-of-work mechanism.

Support

• Symfony 6.4 | 7.4 | 8.0+
• PHP 8.2+
• Webpack | Asset Mapper | Twig

Installation

You can install the package via Composer:

Add bundle into config/bundles.php file:

Add a config file:

YML

config/packages/altcha.yaml

Import bundle routes:

YML

⚠️ Important – Security Configuration

If your application restricts access globally using a rule like:

Then the Altcha challenge endpoint (/altcha/challenge) will also be protected by default.

To allow it to be publicly accessible (as intended for the challenge mechanism to work), you must explicitly add the following rule before the global one:

This ensures that the challenge endpoint is reachable by unauthenticated users, while keeping the rest of your app secure.

Use with your Symfony Form

Create a form type and insert an AltchaType to add the captcha:

Use with Webpack Encore

Optional: usage with UX Live components

There is only one option need to be changed to work with or UX Live component.

Optional: usage with Sentinel

Configure the package by providing your sentinel instance endpoint and your API key:

Activating this configuration will have the effect to use the sentinel server to generate a new challenge and for it's verification. If the sentinel instance is not reachable by the client or by the server, we will fallback on our local configuration.

Need stronger protection?

ALTCHA is invisible to the user, but proof-of-work alone only makes submitting a form expensive — it cannot tell a patient bot from a human. If your forms are being hit by targeted spam that is willing to pay that cost, add a challenge the visitor has to solve.

For that case I recommend tito10047/iconcaptcha-bundle, a Symfony integration of IconCaptcha: the visitor picks the least-common icon out of five to eight. It is self-hosted as well — no third-party service, no tracking, no API key — and it integrates exactly the same way as this bundle: install it, import its route, and add a single field to your form type.

Both bundles can live side by side — use ALTCHA where UX matters most and IconCaptcha on the few endpoints that need a real challenge.

License

The MIT License (MIT). Please see License File for more information.