OdooWiki OCA HUB

Privacy Friendly Captcha

website_altcha folder_open OCA/website open_in_new
Uncategorised License: AGPL-3

This module allows to use a Captcha System completly handled by Odoo.

It relies on Altcha (https://altcha.org), an OpenSource captcha alternative.

auto_awesome What this module does

AI-generated from the code · Odoo 18.0

Adds a self-hosted, privacy-friendly Altcha captcha to website forms, sign-up, password reset and login pages, so visitors must prove they are human before submitting. Captcha settings are configured per website.

This module lets you protect public website forms against bots without sending data to an external captcha service. Everything is generated and checked inside Odoo.

Where it appears: - A new "Altcha" block in the website settings screen, right after the cookies bar setting. It has an enable switch plus fields for the secret keys, the hashing algorithm, the timeout and the cost. - The captcha widget is automatically inserted before the submit button of website forms, and on the sign-up, password reset and login forms. - A demo page at /website_altcha_demo shows how the widget is placed in forms.

Business rules and automatic behaviour: - Turning the switch on generates the two secret keys automatically; turning it off clears them. - Each captcha challenge is stored with an expiry date, and a scheduled cleanup deletes expired entries. - When a protected form is submitted, Odoo checks the captcha answer. If it is missing, invalid, expired or already used, the submission is refused with a "Suspicious activity detected by Altcha" error. - Each captcha can only be used once. - Defaults: PBKDF2/SHA-512 algorithm, 5-minute expiry, cost 5000.

It touches the website configuration, the website settings screen and the HTTP request handling, and adds a new internal model altcha.key for issued captchas.

Depends on

website

Required by other modules

website_event_altcha
Models and fields (4)
  • ir.http · extends an existing model
  • website · extends an existing modelaltcha_key, altcha_cost, altcha_timeout, altcha_algorithm, altcha_private_key
  • altcha.key · new modelkey, used, expires_at
  • res.config.settings · extends an existing modelaltcha_key, altcha_cost, altcha_enabled (Enable Altcha), altcha_timeout, altcha_algorithm, altcha_private_key

Text generated by AI (DeepSeek) from reading the Odoo 18.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 1 confirmed, 8 with no information of 9 versions.

terminal Installation and usage

OCA documentation · Odoo 18.0

Configuration

Source · Odoo 18.0

Go to Configuration/Website, check "Enable Altcha" under "Privacy". Some extra parameters will appear with all the ALTCHA information. This parameters are website dependent.

  • altcha_key: This key is made to create the challenge and review it later

Also, the system adds the option to use some extra parameters:

  • altcha_secret_key: Key used to use deterministic mode. Using it will make it faster from a server perspective.
  • altcha_algorithm: Algorithm used, by default PBKDF2/SHA-512, however, we can use:
  • Fast ones only for testing purposes: SHA-256, SHA-384, SHA-512
  • Good by default: PBKDF2/SHA-256, PBKDF2/SHA-384, PBKDF2/SHA-512
  • Memory Hard: SCRYPT. To be implemented
  • Memory Hard (it required argon2-cffi): ARGON2ID. To be implemented
  • altcha_timeout: Number of minutes that we will trust the key, by default 5
  • altcha_cost: Cost of the challenge. By default, 5000

No verified information in OCA: Installation, Usage.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.