Category: Security · Min plan: Pro · Slug: captcha-protection
Add ALTCHA Sentinel verification to ALL checkout forms — fast checkout on the product page, full checkout, and every order form on landing pages. Stops bots, fake orders, and VPN spam at the door without annoying real customers.
Video tutorial
Features
ALTCHA Sentinel verification on fast checkout, full checkout & landing pages
Self-hosted — no Google reCAPTCHA, no third-party tracking
Three security levels: Normal, High and Aggressive
Invisible to real customers on Normal and High
VPN / proxy / Tor blocking on High and Aggressive
Strict mode: blocks orders with missing or invalid verification
Fail-open on infrastructure issues — never blocks orders due to our errors
Emergency platform-wide kill-switch support can flip for you
Why use it
Algerian COD stores get hammered by: - Fake orders — random names + numbers entered by bots or competitors - Repeat-IP spam — same VPN IP placing dozens of orders - Headless scrapers — automated tools placing orders to test cards or harvest your inventory
ALTCHA Sentinel runs a small proof-of-work challenge in the customer's browser before the order submits. On the default Normal level real customers don't see it — the challenge solves in the background within milliseconds. Bots either fail or take too long. Nothing is filtered before the page renders: the widget always loads, and the decision to accept or reject is taken when the order is submitted.
How to activate
Open Dashboard → Add-ons at
/dashboard/addons.Find Captcha Protection under Security.
Click Activate (Pro plan required).
Security level
The add-on has one setting, Security level, reached from the Settings button on its card:
Level | What it does |
Normal (default, recommended) | Invisible verification. VPN / proxy / Tor visitors are not blocked. |
High | Invisible verification, and also blocks VPN / proxy / Tor visitors. |
Aggressive | Blocks VPN / proxy / Tor, and shows the customer a challenge to solve when they submit the order. |
Two things to know about changing the level:
One-hour grace window. After you switch level, verifications coming from pages that were loaded under the old level keep working for one hour, so customers mid-checkout are not rejected.
Silent fallback. If a level is temporarily unavailable, protection quietly reverts to Normal rather than failing or disabling the widget.
Which forms are covered
The widget renders on:
the full checkout page,
the product page, including all five fast-checkout layouts,
landing page order forms.
It is not applied to orders you create yourself from the dashboard. It also does not render on the Digital theme's own product and checkout pages.
How it behaves
Real customer: nothing visible on Normal and High. On Aggressive, a challenge appears at submit.
Bot / headless / suspicious IP: order is rejected with a generic error. The customer is not told they were flagged (so attackers can't iterate against the rule).
Strict mode: any order missing or carrying an invalid token is rejected — no fallback.
Fake Meta-paid traffic (High and Aggressive only): an order whose tracking tags claim it came from a paid Meta campaign, but which shows no genuine sign of having arrived from Facebook or Instagram, is rejected with the same generic message.
Fail-open: if the verification service has an outage, orders go through normally so real customers are never blocked because of our infrastructure.
Changing mobile IP is fine: a customer whose IP changes between page load and submit — CGNAT rotation, WiFi to mobile data — is no longer blocked for it.
Emergency kill switch
If something goes wrong (you launched a campaign and verification is misbehaving for some segment), support can turn checkout verification off platform-wide. Orders start flowing without verification within seconds. Contact support if you need this.
Tips
Pair with Limit Orders Per IP for layered defense — captcha stops bot signatures, IP limit stops human-driven spam from a single IP.
Pair with Advanced Order Management — your Fake sub-status will see far less use after enabling captcha.
Captcha doesn't slow your store down. The proof-of-work runs in a Web Worker so even slow phones don't lag.
Self-hosted means no data leaves DZBuild — unlike Google reCAPTCHA, no third party sees your customers' browsing.