Bot verification was tied to Google reCAPTCHA. This delivery makes the provider a choice of the installation and adds Cloudflare Turnstile.
What landed
- Configurable provider in the environment panel: none, Google reCAPTCHA or Cloudflare Turnstile. Installations already using reCAPTCHA keep working with no change.
- One validation function for the whole system, used at login, sign-up, password recovery and public forms. The call to the provider is limited to five seconds.
- Key test in the panel itself, before saving.
- Failure counts as abuse: a refused verification enters the count that locks out repeated attempts.
The second step
reCAPTCHA v3 is invisible and gives a score. Anyone with a low score was treated as a bot, with no recourse. With the second step on, the login shows the v2 checkbox; once solved, authentication moves on to checking the username and password.
Passing the verification does not replace correct credentials.
On the Tailwind screens
The access screens migrated to Tailwind did not run the verification, because it depended on the old form validator. The submission is now intercepted without that dependency, for both providers.
Source: Core · req-171 and req-172 · BATCH-176/177