JavaScript seems to be disabled in your browser. For the best experience on our site, be sure to turn on Javascript in your browser.

ModKor

Stop bot spam, fake accounts and brute-force logins with one invisible captcha and three layers of defense behind it. Choose Google reCaptcha (v2/v3), Cloudflare Turnstile or hCaptcha — tested across all four — tick the forms to protect, and save, all from one screen. Hyvä-native and CSP-compliant out of the box, with honeypot, time-trap, per-IP rate limiting, a block log, and configurable fail-open that always keeps login & checkout protected. No separate paid add-ons, no CSS-selector hunting.

SKU: CaptchaBotProtection

$199.00

Requirement

Magento 2.4.8+ (Community Edition)
Hyva 1.4.6+ (License required)
Php 8.4+
Node 20+

12 Month Support Included

Free Installation Included

Look & Feel

Click Here to check the live demo

User Guide

Click Here to view the user guide

Every form on your store is a door for bots — close them all in minutes.

Spam sign-ups, fake reviews, brute-force logins and bot-stuffed newsletters all arrive through your storefront's forms. ModKor Captcha & Bot Protection puts an invisible challenge in front of those forms and adds three more layers of defense behind it — so bots are stopped even when they forge or replay the captcha token.

Pick a provider, paste two keys, tick the forms to protect, and save — everything on one screen with a live preview. No devtools, no CSS-selector hunting, and no separate paid add-on for Hyvä.

One captcha. Four providers. Four layers of defense.

Four providers, one interface

Google reCaptcha v3 — invisible, risk-scored with your own threshold
Google reCaptcha v2 — classic checkbox or invisible
Cloudflare Turnstile — free, privacy-friendly, fully invisible
hCaptcha — privacy-first alternative
Tested across all four; store keys for each and switch the active provider any time

Hyvä-native & CSP-compliant — included

Pure Alpine/vanilla storefront integration (no RequireJS/Knockout)
Works on the Hyvä storefront, Hyvä Checkout and Luma Checkout
Content-Security-Policy compliant — every provider host whitelisted
No separate paid packages, unlike vendors who charge extra for Hyvä, Hyvä Checkout and CSP

Protect any form — no CSS selectors

Nine built-in forms: login, create account, forgot/reset password, edit account, newsletter, contact, product review, share wishlist, email a friend
Add any custom form by its route — no devtools, no selector hunting
data-mk-captcha attribute — drop it on any editable form to protect it instantly
Toggle checkout (place-order) protection with one switch

Layered bot defense (defense in depth)

Honeypot field — invisible to humans, filled by bots
Time-trap — HMAC-signed; blocks impossibly fast submissions
Per-IP rate limiting — caps submission floods and credential-stuffing
Captcha verification — provider token verified (and scored for v3)

Visibility, safety & control

Block log & dashboard — blocked submissions by reason, top forms, top IPs, recent hits
Configurable fail-open — keep shoppers moving during a provider outage, while login, password-reset and checkout always stay protected (fail closed)
IP allowlist, protect-guests-only, per-provider score threshold (v3)
Badge theme, position and language; custom failure message; encrypted secret keys
GraphQL config query for headless / PWA storefronts

Compatibility

Magento Open Source / Adobe Commerce 2.4.8+ · PHP 8.4+ · Hyvä Themes 1.4.6+

Version 1.0.5 — July 1, 2026

Automatically disables Magento's built-in captcha on install — no more two captchas fighting on the same form. The legacy image captcha and native reCaptcha storefront forms are switched off; ModKor Captcha becomes the single storefront challenge. Admin-area captcha is left untouched.

Version 1.0.4 — July 1, 2026

Theme-independent failure notice — a blocked shopper always sees the message on any Hyvä / Magento theme, via a self-contained notice (the module's own styling, no theme CSS needed).

Version 1.0.3 — June 30, 2026

Configurable fail-open — a Bot-defense toggle controls whether shoppers are let through during a provider outage. Login, password-reset and checkout always stay protected regardless.
Precise route matching — protected forms match on URL path-segment boundaries, so a custom route never matches an unintended URL by accident.
Tested across all four providers — Google reCaptcha v2 & v3, Cloudflare Turnstile and hCaptcha.

Version 1.0.2 — June 30, 2026

Security & marketplace-readiness hardening: validated-internal redirect on failure, inline-config output escaping, dedicated time-trap signing key, POST-only log cleanup, and full dependency declarations.

Version 1.0.1 — June 29, 2026

Per-provider "Test connection" button (admin-only) that confirms your keys reach the active provider; missing-keys warning banner.

Version 1.0.0 — Initial release

Multi-provider captcha behind one interface: Google reCaptcha v2 & v3, Cloudflare Turnstile, hCaptcha
Hyvä-native and CSP-compliant — no separate paid packages
Route-based form protection — nine built-in forms plus custom routes and a data-mk-captcha opt-in attribute
Layered bot defense — honeypot, HMAC-signed time-trap, per-IP rate limiting
Block log + dashboard; GraphQL config query; encrypted secret keys

1. What it does

Every storefront form — login, registration, contact, newsletter, reviews — is a door for bots. ModKor Captcha & Bot Protection puts an invisible challenge in front of those forms and adds three more checks behind it, so automated abuse is stopped even when a bot forges the captcha token. Everything is configured on one screen with a live preview.

The Captcha dashboard — The complete Captcha dashboard on Default scope. Open it at **Admin → ModKor → Captcha**.

Highlights

Four providers, one interface — Google reCaptcha v3 & v2, Cloudflare Turnstile, hCaptcha (tested across all four).
Hyvä-native & CSP-compliant out of the box — no separate paid add-on.
Route-based form protection — tick built-ins or add any form by route. No CSS selectors.
Layered defense — honeypot, HMAC time-trap, per-IP rate limiting.
Configurable fail-open — shoppers keep moving during an outage; login & checkout always stay protected.
Block log & dashboard, multi-store overrides, encrypted keys, GraphQL, interactive live demo.

2. Requirements

Magento Open Source / Adobe Commerce 2.4.8+
PHP 8.4+ · Hyvä Themes 1.4.6+ (storefront)
ModKor_Core (ships with the suite)
A free account with at least one provider (reCaptcha, Turnstile or hCaptcha)

3. Installation

composer require modkor/module-captcha
bin/magento module:enable ModKor_Core ModKor_Captcha
bin/magento setup:upgrade
bin/magento setup:di:compile            # production
bin/magento setup:static-content:deploy # production
bin/magento cache:flush

Find it under ModKor → Captcha (also mirrored under Stores → ModKor). The module installs inert — captcha stays off until you add keys and switch it on, so installing it can't break a form.

Replaces Magento's built-in captcha automatically. On install it switches off Magento's own storefront captcha (the legacy image captcha and native reCaptcha form assignments) so you never have two captchas fighting on the same form. Your admin-area captcha is left untouched. Nothing to configure — it happens during setup:upgrade.

4. Quick start (90 seconds)

Get keys from your provider (§8). Cloudflare Turnstile is the easiest first choice.
Open ModKor → Captcha. In Provider keys, paste the Site key and Secret key.
Click Test connection to confirm the keys reach the provider.
In General, set Active provider and switch Enable captcha to ON.
In Protected forms, tick the forms to guard, then Save changes.

Provider keys with Test connection — Provider keys: paste site + secret keys per provider, then Test connection. Only the Active provider is served on the storefront.

5. The dashboard, section by section

Scope (multi-store)

Default covers your whole store; pick a store view to give it its own provider, forms or thresholds. Anything you don't override inherits from Default.

The Scope selector — Default (whole store) or any individual store view.

General

Active provider, master enable switch, badge theme/position, language, failure message, protect-guests-only, and an IP allowlist (these bypass all checks).

Protected forms

Tick built-in forms, toggle checkout protection, and add custom routes — one POST route per line, no CSS selectors.

Bot defense

The layers that run with the captcha: honeypot, minimum fill-time, per-IP rate limiting, and the fail-open toggle.

Block log

Live stats (today / 7-day / all-time, by reason) and the most recent blocks. The full grid is at ModKor → Captcha → Block Log.

6. Choosing a provider

Provider	Best for
Cloudflare Turnstile	Most stores — free, privacy-friendly, invisible. Recommended start.
Google reCaptcha v3	High-traffic stores wanting a risk score (invisible).
Google reCaptcha v2	Stores that want a visible "I'm not a robot".
hCaptcha	Privacy-focused / GDPR posture.

7. The "Test connection" button

After entering your keys, click Test connection — the module reaches the active provider with your secret and confirms the connection is working. It works with all four providers and reports a clear error if the provider can't be reached.

Test connection result — Test connection: a green confirmation that your keys reach the active provider.

8. Getting your keys

Cloudflare Turnstile — dash.cloudflare.com → Turnstile → Add widget. Name it, add your hostname, mode Managed, Create. Copy Site + Secret keys.
Google reCaptcha — google.com/recaptcha/admin → register a site → v3 (scored) or v2 → add domains → copy Site + Secret keys.
hCaptcha — dashboard.hcaptcha.com → New site → copy Site key; get the Secret key from Settings.

Add every store hostname that will serve the widget, or the provider will refuse its tokens.

9. Protecting custom forms

By route: in Protected forms → Custom form routes, add the form's POST route (e.g. mymodule/index/save), one per line. By attribute: add data-mk-captcha to any <form> you can edit. AJAX-injected forms are covered automatically.

10. Multi-store overrides

Choose a store view, turn on Override in a section to give that storefront its own settings, and leave it off to inherit from Default.

Per-store override — With a store view selected, turn on "Override" in a section to set a different value just for that storefront.

11. Fail-open & safety

If a provider is unreachable at submit time, the Fail open on provider outage setting (Bot defense) decides what happens. By default shoppers are let through and the event is logged rather than blocking everyone — but login, password-reset and checkout always fail closed, so an outage can never slip past the captcha on your most sensitive forms. Turn the toggle off to fail closed everywhere. Secret keys are stored encrypted.

12. Headless (GraphQL)

{ mkCaptchaConfig { enabled provider siteKey badgeTheme badgePosition } }

Returns the active public config (never the secret) so a PWA / headless storefront renders the right widget.