PoW CAPTCHA for Flarum

peopleinside

PoW CAPTCHA for Flarum

A local Proof-of-Work CAPTCHA extension for Flarum that protects login, registration and password-reset forms without relying on any external service (no Cloudflare, no Google reCAPTCHA, no cookies).

How it works

When an auth modal opens, the browser silently fetches a one-time challenge from the Flarum API.
The browser solves a SHA-256 hash puzzle (finds a nonce N such that SHA-256(challenge:N) starts with D hex zeros, where D is the configured difficulty).
The solution token challenge:nonce is appended to the form submission.
The server verifies the solution and rejects the request if the check fails.

Bots must solve the same puzzle for every request; legitimate users complete it invisibly in the background (< 100 ms at the default difficulty).

Features

🔒 No external services – fully self-hosted
⚡ Invisible to users – solved automatically while they fill the form
⚙️ Configurable difficulty – 5 levels (< 1 ms → ₁₀ s)
🌓 Dark / light mode – widget adapts to Flarum's current theme
🌍 Italian & English – auto-detected; add more locales in locale/
🔁 Replay-proof – each challenge is single-use (stored in Flarum's cache)
✅ Flarum 1.x and 2.x compatible

Requirements

Dependency Version
PHP | ≥ 8.1
Flarum | ¹.0 or ².0

Screenshot

Installation

composer require peopleinside/fla-powcaptcha

Then enable the extension in the Flarum admin panel.

Update:

composer update peopleinside/fla-powcaptcha

How to remove

composer remove peopleinside/fla-powcaptcha

After install, removal or update run

php flarum cache:clear

Minimal support.

Support Links:

License:

Apache License Version 2.0

Karl

Please include License.

peopleinside

Sure, I will do now.

Karl

peopleinside I still don't see it on your post.

peopleinside

Karl Oh you mean in the post.
OK I will insert in the post.

flavour1

2.4.2 seems to break my forum (1.8.16, php 8.3) in a weird way: many other extensions will not work correctly anymore and login even fails from time to time. this must be some flarum.reg error.

peopleinside

flavour1 hi, thank you for your report and very sorry for the issue caused.
I am aware of the issue and I will try my best to resolve as soon as possibile.
Today, just right now I will try to fix asap.

I'm having also issues to migrate to Flarum 2.0 but today I started again and I'm with one community to Flarum 2.0 rc3.
For now I suggest to use Cloudflare Turnstile for Flarum but I hope in just some hours or today to release a fix.

To resolve issues you can for now remove the Pow Captcha extension: composer remove peopleinside/fla-powcaptcha

flavour1

no worries, i downgraded via composer require peopleinside/fla-powcaptcha:2.4.1 meanwhile.
I try to avoid cloudflare and any other external services - thats why your extension is such a great addition!
ciao & mille grazie!

peopleinside

Previous version can block registration (new users).
Unfortunately I'm having a lot of troubles with some internet rule changes.
I'm working right now to made a fix.

The intention of my PoW Captcha extension is to provide a privacy focused solution easy to use that not require complex server configuration. As I never found an easy option i tried to create this solution that would be what I will use directly on my small fortum.

I will try to update you also here as soon I found a fix.

peopleinside

@flavour1
🎉 Version 2.4.3 should resolve issues with Flarum 2.0
Still need verify security but what was changed was just to load settings on admin and on front end.

As soon possibile I will check also if need some code and security improvement but for now should be ok and more safe then old versions that if are old means some issues has been detected.

For example version 2.4.1 was not allowing new users registration this is why version 2.4.2 was released but it's an hard work for me made extension compatible both with the "old" Flarum 1.8 and the new 2.0

😊

I tested and version 2.4.3 seems works fine.
You can update with
composer update peopleinside/fla-powcaptcha
then check on backend the version has been updated, if not try
composer require peopleinside/fla-powcaptcha

flavour1

thank you very much for your efforts on the extension!

peopleinside but it's an hard work for me made extension compatible both with the "old" Flarum 1.8 and the new 2.0

i totally understand. And I feel a bit guilty already, for still sticking with 1.8.16 on my production forum 🙈
cause as expected, 2.4.3 still breaks on 1.8.16.

The generated bundles contain:

flarum.reg.get(...)
flarum.reg.add(...)

and fail on Flarum 1.8.16 because flarum.reg is undefined.
The TypeScript sources appear correct (import app from 'flarum/forum/app', etc.), so the issue is likely in the webpack/flarum-build configuration that produces the published dist assets. Rebuilding with the standard Flarum frontend build setup should resolve it, i.e. the extension needs to be rebuilt with the same frontend build tooling used by Flarum 1.8.

peopleinside

Let me know if now the PoW Captcha works, seems is working for me I tested login, password reset and user registration.

MrLaviana1

🔥 Good job!, installed and working!

peopleinside

Great, thank you for the feedback.

flavour1

peopleinside

it is working well on my flarum 2.0.0-rc.3 test installation, but on my production flarum 1.8.16 forum I still get the

[Error] TypeError: undefined is not an object (evaluating 'flarum.reg.get')
	(anonymous function) (forum.js:2195:272)
	(anonymous function) (forum.js:2195:5087)
	Global Code (forum.js:2195:5109)

you said reverting back to 2.4.1 will bring issues with the registration.
would reverting to 2.3 be an option for my 1.8.16 forum ?

peopleinside

On Flarum 1.8 you need use the version 2.3
Unfortunately I'm unable to made the same version work for both.
Soon the Flarum supported will be the 2.0

I am opened if some developer want contribute to the extension 😊