Form spam without Google. A proof-of-work challenge that your own Odoo instance generates and verifies — no third party, no cookies, no account.
| Technical name | website_altcha |
|---|---|
| Version | 19.0.1.0.0 |
| Odoo | 19 · Community and Enterprise |
| Depends on | website |
| External services | None |
| Cookies set | None |
| Outbound network calls | None |
| Configuration | Settings ‣ Website ‣ Spam Protection (ALTCHA) |
| Automated tests | 10 cases covering the happy path, replay, expiry, forged signature, tampered answer, malformed payload, missing key and cleanup |
When a visitor opens a protected form, their browser fetches a challenge from your Odoo instance and solves a small computational puzzle in the background. For one visitor that costs a few milliseconds and no interaction. For someone sending ten thousand submissions, the cost multiplies — which is the point.
Your server signs each challenge and verifies the answer locally. Nothing is sent anywhere. That is precisely why no consent banner, no data processing agreement and no privacy policy amendment is required.
Replay protection matters more than it sounds. Without it, a valid solved challenge can be reused until it expires — an attacker solves one puzzle and then submits in volume at no further cost. Here each challenge is spent exactly once, enforced by a unique database index, so two concurrent requests race for the insert and exactly one wins.
| reCAPTCHA / Turnstile | This module | |
|---|---|---|
| Visitor data sent to a third party | Yes | No |
| Cookies / fingerprinting | Yes | None |
| What the visitor does | Image grids, audio puzzles | One checkbox |
| Screen reader friendly | Partly, with effort | Yes |
| Account and API keys | Required | None |
| Consent banner needed | Yes | No |
The module installs in monitor mode. Failed challenges are written to the log but nothing is rejected. You see your real spam volume, and you see whether legitimate submissions would have been caught — before anyone is turned away. When the log looks the way you expect, switch on Block failed submissions.
This ordering is deliberate. A spam filter that starts by blocking is a support ticket waiting to happen.
The module is finished and tested against a clean Odoo 19 installation. It is being prepared for publication on the Odoo Apps Store. If you want it before it is listed, write to florian@neuhuber.net — early feedback is worth more to us than a tidy launch date.
Scope: proof-of-work raises the cost of automated submissions. It is a strong deterrent against volume spam, not a defence against a determined human attacker — no CAPTCHA is.