# Adding CAPTCHA protection to an Elgg site

> Stop bots creating accounts and posting spam on your Elgg community site by enabling a CAPTCHA plugin or Google reCAPTCHA.

Source: https://helpcenter.ruachost.com/apps/other-apps/adding-captcha-protection-to-an-elgg-site/

**CAPTCHA** protection helps secure your Elgg community site by preventing automated bots from creating accounts, posting spam, or abusing forms. On **ruachost.com**, you can enable CAPTCHA or integrate Google reCAPTCHA for stronger protection.

## Why Use CAPTCHA?

- Blocks automated registrations and spam submissions.
- Protects login and registration forms from brute‑force attacks.
- Improves overall site security and user trust.

## Enabling CAPTCHA in Elgg

### Step 1: Install the CAPTCHA Plugin

1. Download the official **Elgg CAPTCHA plugin** or a third‑party plugin such as **Elgg reCAPTCHA**.
2. Upload the plugin to your Elgg installation’s `mod` directory:

   ```bash
   /home/username/public_html/elgg/mod/
   ```
3. Log in to Elgg as the **administrator**.
4. Go to **Administration → Plugins**.
5. Locate the CAPTCHA plugin and click **Enable**.

### Step 2: Configure CAPTCHA Settings

1. In the Elgg admin panel, go to **Administration → Settings → CAPTCHA**.
2. Choose where CAPTCHA should appear:

   - Registration form
   - Login form
   - Contact form
   - Comments/posts
3. Adjust difficulty settings (number of characters, distortion, etc.).
4. Save configuration.

## Adding Google reCAPTCHA to Elgg

For stronger protection, use **Google reCAPTCHA**:

1. Register your site at the Google reCAPTCHA Admin Console.
2. Obtain your **Site Key** and **Secret Key**.
3. Install the **Elgg reCAPTCHA plugin**.
4. In Elgg admin, go to **Administration → Settings → reCAPTCHA**.
5. Enter your keys and select which forms to protect.
6. Save configuration.

## Important Notes

- CAPTCHA plugins must be compatible with your Elgg version.
- Test CAPTCHA on a staging site before enabling it on production.
- If CAPTCHA fails to display, clear Elgg’s cache and check theme compatibility.
- Google reCAPTCHA v3 is less intrusive but requires tuning to avoid false positives.