GateCHA CAPTCHA

FAQ

What is GateCHA?

GateCHA is a self-hosted CAPTCHA management service that wraps the ALTCHA proof-of-work protocol. It provides API key management, multi-site support, and an analytics dashboard. See the GateCHA website for more information.

How does proof-of-work CAPTCHA work?

Instead of asking users to solve image puzzles, the browser solves a small computational challenge in the background. This is invisible to legitimate users but expensive for bots trying to submit forms at scale.

Is my API key secure?

The API key is used in the browser to fetch challenges, similar to how reCAPTCHA and hCaptcha use site keys. You can restrict your API key to specific domains in your GateCHA dashboard for additional security.

Does this plugin send data to external services?

Only to your own GateCHA instance. No data is sent to any third-party service. See the External Services section below.

What are interaction signals?

Proof-of-work proves a browser did the work. It does not prove a human filled the form in, and a headless browser solving the challenge passes it exactly like a visitor does. Interaction signals describe how the form was filled: how long the page was open, whether the pointer moved and how far, how many scrolls, touches and keystrokes there were, and how irregular the typing rhythm was. Your GateCHA instance turns those eight numbers into a score between 0 and 1, where higher means more likely automated.

Only aggregates leave the browser. Never what was typed, never where the pointer was, never an IP address. Turn it on under Settings → GateCHA → Interaction Signals.

Does enabling interaction signals block anyone?

Not by itself. Collection only records scores, which you can watch on your GateCHA dashboard under HIS Monitor. Rejecting flagged submissions is a second, separate setting.

Turn that second one on only once you have watched your own traffic, because a false positive is invisible: the visitor cannot submit and will not tell you. To see the scores in your own logs first, hook the gatecha_his_result action:

add_action( 'gatecha_his_result', function ( $score, $suspected ) { error_log( "GateCHA HIS $score" ); }, 10, 2 );

Can I use this with a custom form?

Yes, use the [gatecha] shortcode to place the widget anywhere. Then verify the altcha POST field server-side.

How do I bypass the CAPTCHA for automated testing (e.g. Playwright)?

Define a bypass token in your wp-config.php:

define( 'GATECHA_BYPASS_TOKEN', 'your-secret-test-token' );

Then in your tests, set the altcha hidden input to this token before submitting the form:

document.querySelector('input[name="altcha"]').value = 'your-secret-test-token';

The plugin will accept the token as a valid verification without contacting the GateCHA server. Never define this constant in production.