A very good (and free) captcha class in PHP (Recommendation)

[JoTo]

Hi DCs,

i was in need to protect a submission page of one of my projects with a captcha. So i searched for a good, easy to use, mighty, customizable and free class. I kissed a lot of frogs until i found my prince. I told Mouser in the IRC channel that i now found a very good one (IMHO). I'd better resisted to tell him, because now he urged me to write this post to annoy you all  and share my experience with it.

OK, as Mouser is root, his wish is my command And as the forum search don't showed up a mention of my finding yet, i'm now sitting here and typing. *sigh*

Well i lastly landed and went with SecurImage (http://www.phpcaptcha.org/)

SecurImage sample from my page:
[attach]

[vlastimil]

I should apologize for this post in advance. I know, you think you have found a very good thing, but I do not believe there is or ever will be a "good" captcha. They are a major annoyance for end users. Putting them on your web site is like saying "I hate you" to your visitors. Spam is your problem, you should solve it. It is not your visitor's problem. They don't care.

I have 0 captchas on my site and the level of spam I am getting is negligible. It is because my forms are protected by other means. I use invisible codes that expire after some time, I do not have the form source code in the html, but use javascript to display it. I submit the forms via ajax. This improves the user experience and prevents spam.

Google for "without captchas" and you'll get a lot of resources. It takes more time to build a site without captchas, but it is worth it.

[Ath]

Finally i just recommend this class highly to all who search a free, easy to use, customizable captcha class with a kind and responsive author for their PHP projects.

Reading this very fine mini-review (IMHO), though I do nothing in php at the moment, it's surely one I'm going to remember!

[JoTo]

Hi Vlastimil,

i agree with you that captchas are annoyances. Don't tell that to me as a visually impaired person. *sigh*

But there are situations where you need them. This is my one and only captcha page for now. But it's a license request page and i don't want to get customers loose under a pile of spam. And with your code system you can't even ban a bot cover valuable mails under a mess of spams.

Furthermore i offer a direct license request way directly from the application too. You don't have to visit that page. It's just for the one's that reject to use the "normal" convinient way. And if you want to say i must agree: THAT people that don't use the recommended way i hate, yes, yes and yes!

So if we agree that captchas are bad at all, and that there ARE situations where you need one, my finding is still one of the better ones.

And as we talk about Javascript. What if you have customers with JS disabled? Doesn't that mean you hate them when you make your pages unusable without JS? E.g. in my browser JS is disabled and scripts are blocked all the time unless i allow a page to execute scripts. How annoying if i have to enable scripts all the time.

And there is no need for an excusation anywhere. Thank you for your thoughts and as you see, we aren't far away from each other, are we?

Greetings
JoTo

[cranioscopical]

i'm now sitting here and typing. *sigh*

And thank you for the effort!
It's good to learn about items like this, to keep in a back pocket in case of need.

That mouser, what a slave driver! 

[vlastimil]

So if we agree that captchas are bad at all, and that there ARE situations where you need one, my finding is still one of the better ones.

And as we talk about Javascript. What if you have customers with JS disabled? Doesn't that mean you hate them when you make your pages unusable without JS? E.g. in my browser JS is disabled and scripts are blocked all the time unless i allow a page to execute scripts. How annoying if i have to enable scripts all the time.

I guess, the way your use of captchas is perfectly fine. If you do not actually want people to use that form, captcha is a good way .

It is true that some of the functionality of my pages will not be available to people with JS disabled. This affects 1-2% of visitors - captchas in wrong place affect 100%. I am happy with that state, especially when the interaction with the web is way smoother for the 98-99% with JS on.

[rgdot]

In registration and contact form situations captchas are as close to ineffective as one can get, in those and most other situations one really should use a question/answer script.
As an inconvenience it is only mildly so in my opinion, I think by now most understand why they exist and accept them, it's worse if they are not effective - so later the user doesn't see its benefit - which takes us back to using question/answer.

[Renegade]

I should apologize for this post in advance. I know, you think you have found a very good thing, but I do not believe there is or ever will be a "good" captcha. They are a major annoyance for end users. Putting them on your web site is like saying "I hate you" to your visitors. Spam is your problem, you should solve it. It is not your visitor's problem. They don't care.

I have 0 captchas on my site and the level of spam I am getting is negligible. It is because my forms are protected by other means. I use invisible codes that expire after some time, I do not have the form source code in the html, but use javascript to display it. I submit the forms via ajax. This improves the user experience and prevents spam.

Google for "without captchas" and you'll get a lot of resources. It takes more time to build a site without captchas, but it is worth it.

Custom solutions always work better because any solution that gains any kind of popularity is targeted by spammers.

Form protection with custom IDs and names is fairly easy to break though. Codes are the same. I came across that on one site I was doing some automation with. It took a few extra minutes to get things working.

But using JavaScript and AJAX is a good deal better to protect things. It forces you to check the rendered document, which is more difficult than simply walking the DOM to find things.

+1 for no CAPTCHAs. They're simply horrible to deal with. I've been at sites that I couldn't figure out the CAPTCHA for. Not fun.

[mahesh2k]

I don't care for readers if they can't understand my trouble with bots and russian captcha breaker sites. I need to use captcha if captcha breaker sites or xrummer or similar sites hurt my blog or site. Economic times are very hard, if i have to choose between captcha and readers, my vote goes to captcha. Readers (which are not converting for me in terms of any value) are not helping me in any way. I have to sort spam and server load if i don't pay attention to spam bots or manual spammers. So i'm with captcha, as long as it gives me result.

[Renegade]

I don't care for readers if they can't understand my trouble with bots and russian captcha breaker sites. I need to use captcha if captcha breaker sites or xrummer or similar sites hurt my blog or site. Economic times are very hard, if i have to choose between captcha and readers, my vote goes to captcha. Readers (which are not converting for me in terms of any value) are not helping me in any way. I have to sort spam and server load if i don't pay attention to spam bots or manual spammers. So i'm with captcha, as long as it gives me result.

I'm not sure I know what you mean there.

[Carol Haynes]

Rather than using annoying captchas why not have a random general knowledge question from a list. Choose one word answer questions that anyone with half a brain knows the answer to but bots can't do. Helps the visually impaired than because they can use a screen reader to work out what is required!

[Renegade]

Rather than using annoying captchas why not have a random general knowledge question from a list. Choose one word answer questions that anyone with half a brain knows the answer to but bots can't do. Helps the visually impaired than because they can use a screen reader to work out what is required!

But what would that be?

The problem is that problems like that (e.g. CAPTCHAs) are more easily solved by computers.

Lists are easily broken.

[Carol Haynes]

Lists are easily broken if they are in common use - but how about  individual lists designed for a specific website?

You could have a long list of very stupid questions like:

what colour is blue grass?

To a human the answer is obvios but not to a computer. If that question appears on one website how long is it going to take a bot to crack it?

If the website is not intended to be for locals only then you cold ask very specific questions that only locals can answer.

[vlastimil]

I do not consider questions better than awkwardly twisted words. It shall not be the user's task to prove that they are human.

Spam only works because it is automated and stock CMS solutions are low hanging fruits, especially the free ones like Wordpress or Drupal. By adding a bit of a non-standard code, the problem is solved. A spammer will not bother writing custom script for just one website. And if they do, the webmaster can react by changing a little detail. The spammer has to spam 100s of webs, while the web owner only has 1 (or a few) to care about. Web masters, who care, win easily.

(Of course, if a web site owner has dozens of sites, then I understand they would want to use captchas. In that case, I have my doubts about the quality of the sites. It takes a lot of time to maintain and add valuable content to just a single web site.)

[mahesh2k]

Rather than using annoying captchas why not have a random general knowledge question from a list.

Lists if are limited in number can be easily broken because there are sites which pays users to break captcha for 0.01$/captcha for succesful 50 breaks and 0.001 if there are mistakes. Plus there are softwares like xrummer and scrapebox which are built so effectively that they can create mass accounts to spam on forums, blog comment etc. These softwares attack at the rate 1000 comments per minute or more depending on server strength/software type. Random stupid questions are likely to work but they're limited in number and if humans are cracking captchas for low cost then they're not effective at all.

Splashpress media, Demand media and many other webmaster who employ writers to write on their sites use captchas or IP block softwares to get rid of comments which are junk or attack content. It's useless to think about non-paying reader to your content sites reputation. You've right to protect your property regardless of readers who moan/whine against anti-spam solution. That's business. Considering the attention span of readers, there are hardly any dedicated readers that sticks to any blog or (free) content website for long. Then there is google algorithm change which hurts site based on spam comment/bot attacks on forums etc. All other SEO factors are there as well which expect webmaster to get rid of that garbage with or without traffic. Captcha is the solution to consistent spam problem, so if it works we need to use it. Why bother about freebie readers if they can't understand your problem ?