Revision as of 12:50, 18 November 2020

Differentiating between humans and bots (computers) is an ever-changing and more challenging task. A number of solutions have been implemented, typically involving increasing obscured text and numbers or images, such as the default 5 character verification of WHMCS.

As bots and software have become more sophisticated, a common solution was to make the text more difficult to read, which can result in frustrated and lost potential clients. Google's reCAPTCHA set's out to change that. They have created a system that is easy for people, but hard for bots. By using an advanced and more secure risk analysis engine, humans and bots are more effectively differentiated.

The first step in authentication is to ask the user to confirm that they are not a robot by ticking a checkbox. While this sounds simple, Google's risk analysis engine takes a lot into account about how the user came to tick the checkbox, including how the user responds before, during, and after the action. In cases where the engine cannot confidently differentiate, a mobile-friendly verification tool like image selection from a list may be supplied or a CAPTCHA itself.

Google reCAPTCHA V2 is available in WHMCS 7.0 and later.
Google Invisible reCAPTCHA is available in WHMCS 7.7 and later.

Enabling Google reCAPTCHA

Google's reCAPTCHA may be enabled by following these steps:

• Navigate to Configuration () > System Settings > General Settings > Security or, prior to WHMCS 8.0, Setup > General Settings > Security.
• Under the setting Captcha Type, select reCAPTCHA
• Visit https://www.google.com/recaptcha/admin and log into your Google account
• Click the "Register a new site" option, enter in a label for your key and select the "Invisible reCAPTCHA" option.
• Be sure to enter in your domain under the "domains" section and then accept the Google terms of service and click the Register button to finish registering your site and generating your keys.
• Copy the Site Key and Secret Key issued by Google and enter them in the fields provided in WHMCS.
• Save Changes to complete the process

Enabling Invisible reCAPTCHA

reCAPTCHA Key Generation

To enable the Invisible reCAPTCHA feature for the shopping cart, follow these steps:

• Navigate to Configuration () > System Settings > General Settings > Security or, prior to WHMCS 8.0, Setup > General Settings > Security
• Under the setting Captcha Type, select Invisible reCAPTCHA
• Visit https://www.google.com/recaptcha/admin and log into your Google account
• Click the "Register a new site" option, enter in a label for your key and select the "Invisible reCAPTCHA" option.
• Be sure to enter in your domain under the "domains" section and then accept the Google terms of service and click the Register button to finish registering your site and generating your keys.
• Copy the Site Key and Secret Key issued by Google and enter them in the fields provided in WHMCS.
• Save Changes to complete the process

Captcha Locations

You can choose which forms have a captcha enabled on them by checking the appropriate boxes in the "Captcha for Select Forms" option. The following options are available:

• Shopping Cart Checkout - On checkout in the Client Area
• Domain Checker - The homepage domain checker, and on the Register or Transfer domain pages in the cart
• Client Registration - register.php
• Contact Form - contactus.php
• Ticket Submission - When submitting a ticket
• Login Forms - Admin and Client login forms

Troubleshooting

Invalid Site Key/I can't login

If the site key specified under General Settings isn't valid for some reason and is preventing logins to the admin area to correct it, it will be necessary to disable reCAPTCHA manually via the database (setting "Captcha Form Protection " to "Always Off" temporarily to resolve this. Please take a backup of the database and then run the following SQL query using a tool like phpMyAdmin to do so:

UPDATE tblconfiguration SET value = '' WHERE setting = 'CaptchaSetting';