Human verification asks visitors of a public form to prove they are not a bot: a checkbox, or an invisible check scored by the provider. It adds to the protections already in Portail ZAPP (hidden field, fill-time check, rate limits, account lockout), which stay active in every case.
The Human verification screen (menu Administration › Users & access › Authentication › Human verification) is reserved for Administrators.
Choose a provider
| Provider | Notes |
|---|---|
| None | No challenge and no call to the outside. This is the setting for instances without Internet access. |
| Cloudflare Turnstile | Free, unobtrusive, no Google account. |
| hCaptcha | Visual challenge, privacy-oriented. |
| Google reCAPTCHA v2 | “I'm not a robot” checkbox. |
| Google reCAPTCHA v3 | Invisible: every submission gets a score between 0 and 1 and is refused below the minimum score you set (0.5 by default). |
First create a site with the provider you chose: it gives you a site key (public) and a secret key. Enter both here. The secret key is never displayed again: the screen only says it is set; leave the field empty to keep it, tick Clear to remove it.
Choose the protected forms
Each family of forms is switched on separately:
- Registration: self-registration and re-sending the verification message;
- Forgot password;
- Sign-in: the challenge only appears after several failures, from the same IP address or on the same account. Set the number of failures (3 by default) and the counting window (15 minutes);
- Guest forms: a guest's comment on a ticket or request, catalog orders without an account;
- Satisfaction surveys: answering a survey received by email.
Registration and forgot-password stay protected as soon as a provider is chosen; the other families are for you to switch on.
If the provider does not answer
For each family, choose what happens when the provider is unreachable (outage, timeout) or rejects your keys:
- Refuse (default for registration, forgot password, guest forms and surveys): the submission is rejected as long as the provider does not answer;
- Let through (default for sign-in): the submission goes on; only account lockout and rate limits then protect the form. Never block sign-in on an outside outage: nobody, you included, could log in.
Good to know
- Privacy: the provider receives the IP address and browsing data of every visitor of the form. Mention it in your privacy policy. For reCAPTCHA, prior consent is generally required in Europe; Turnstile and hCaptcha are easier to justify.
- Instance without Internet: keep None.
- API: public API calls (sign-in, registration, forgot password) have no widget; they keep their rate limits. An API client may attach a token obtained from the provider. Failed API sign-ins do count toward the sign-in failure threshold, though: an account attacked through the API gets the challenge on the sign-in page.
- Content Security Policy: if your web server enforces a Content Security Policy (CSP), allow the chosen provider's addresses (script, frame and connection), listed in the module's technical documentation.
- Settings apply immediately, without a restart.