If you are a web developer and use Google Recaptcha (or any service that uses Google Recaptcha like Cloudflare or Incapsula), you unintentionally lock out and delay many potential and existing users. This is because Google bases captcha processing on your users IP addresses. This is harmful because a spammer with the same IP address (such as in same college, public hotspot, wifi access point, VPN or Tor network) can lock out or inconvenience the majority of legitimate users. Legitimate users are often forced to spend 2 minutes repeating captchas (only to have Google reject their answer due to their IP address), have no access to audio captchas for accessibility, or be locked out from accessing your website entirely with the error: "Your computer or network may be sending automated queries. To protect our users, we can't process your request right now. For more details visit our help page". This inconvenient delay or complete lockout means that users will not want to come back to your website, will click away from registration and checkout, or will use their accounts less often.
What to do? It is unfortunately difficult to tell someone in a public network, VPN or Tor to stop spamming (and there are better ways to prevent spam than indiscriminate IP blocking), and due to legitimate personal privacy and safety concerns, it is not reasonable to ban users from using VPN or Tor. Therefore the solution is to acknowledge that many users are behind the same IP address and not reject captchas based on IP address alone. There are many other captcha libraries that are easy to install, keep out spam and dont indiscriminately block based on IP - meaning that your users are judged on their actions, not on who shares their IP address.
For example, Securimage is a simple but effective PHP text captcha with accessible audio option. You can download Securimage here:
https://www.phpcaptcha.org/
Or take a look at other captcha libraries for other languages:
https://github.com/lorien/awesome-captcha
Another service that often locks out legitimate users based on IP address are CDNs like Cloudflare, Cloudfront and Incapsula. In this case Cloudflare is slightly better as it allows legitimate users to access your website after waiting or completing a captcha, whereas Incapsula often locks out legitimate users entirely based on their IP address. Such CDNs offer basic hiding of server IP, shared SSL certificate, rate limiting (helps to protect against spam, DDOS and brute force), cache (faster page load speeds), and web application firewall (helps to protect against XSS, SQL injection and similar attacks). However you can set up such protection on your own server, and avoid MITM CDNs that can lock out and inconvenience your legitimate users.
Hide server IP
SSL certificate
Rate limiting
Cache
Web application firewall
In conclusion, for accessibility reasons and to create a better and more convenient experience for your users, consider to switch Google Recaptcha for Securimage or use one of many captchas and CDN services that doesnt block based on shared IP address.
If you found this guide useful, feel free to send a contribution to 1CaLCR5mGwS4FJzU1HZm9qwr5WoRYFDdyB (BTC).
This article was written by Web4Crypto. Web4Crypto offers web development, web design, programming and scripting services from $40 and accepts Bitcoin, Monero, Ethereum and other cryptos. Visit https://web4crypto.xyz for more information and a free consultation.
