FAQ
Overview · Installation · Configuration · Usage · Developer notes
Do I need an account with Cloudflare or hCaptcha?
Section titled “Do I need an account with Cloudflare or hCaptcha?”No. The built-in check works without any account or key. Turnstile and hCaptcha are optional; both have free plans.
Is the built-in check privacy-friendly?
Section titled “Is the built-in check privacy-friendly?”Yes. It sets no cookies, loads nothing from other servers and sends nothing to a third party. The task runs in the visitor’s browser; the server only checks the result.
Will customers have to solve puzzles?
Section titled “Will customers have to solve puzzles?”Not with the built-in check or Turnstile in most cases. hCaptcha may show a picture task to suspicious visitors.
Does it stop all spam?
Section titled “Does it stop all spam?”It stops automated spam: bots that fill hidden fields, send forms within seconds, cannot run the check, or send many forms from one address. People who fill forms by hand are not stopped by any captcha.
How is this different from the built-in Google reCAPTCHA?
Section titled “How is this different from the built-in Google reCAPTCHA?”reCAPTCHA sends visitor data to Google, uses Google cookies and needs keys. Captcha Pro offers a check without any third party, Turnstile and hCaptcha, per-form rate limits, a honeypot, an allow-list, statistics, and it also protects password recovery, product reviews and the admin sign-in, which reCAPTCHA does not check.
I use reCAPTCHA now. Can I switch?
Section titled “I use reCAPTCHA now. Can I switch?”Yes. While reCAPTCHA has keys, Captcha Pro stays inactive; click Switch to Captcha Pro on Customers → Spam protection. It protects the same forms and disables reCAPTCHA.
My store is behind Cloudflare. Do the rate limits still work?
Section titled “My store is behind Cloudflare. Do the rate limits still work?”Enter the Cloudflare IP ranges under Trusted proxies. Otherwise all visitors would share Cloudflare’s addresses. Proxies on the same server (Varnish, nginx) are recognized automatically.
Can bots fake their IP address to get around the limits?
Section titled “Can bots fake their IP address to get around the limits?”No. Forwarded headers are only read from trusted proxies.
Does it work with the full page cache of CS-Cart 4.21?
Section titled “Does it work with the full page cache of CS-Cart 4.21?”Yes. The widget is the same for every visitor and the check runs in the background.
What happens if Turnstile or hCaptcha is down?
Section titled “What happens if Turnstile or hCaptcha is down?”By default forms are accepted if they pass the built-in check, so customers can still register and check out. You can choose to refuse the form instead.
I locked myself out of the admin panel.
Section titled “I locked myself out of the admin panel.”Add define('KV_CP_EMERGENCY_OFF', true); to config.local.php, sign in, fix the setting (for example add your IP address to the allow-list), then remove the line.
What happens if the license lapses?
Section titled “What happens if the license lapses?”Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), Captcha Pro stops checking forms and its rate limits stop; CS-Cart’s own behaviour returns (Google reCAPTCHA, if you set it up), and your form settings, keys and statistics are kept. Once the license is valid again, everything is back.
The admin panel shows a license notice.
Section titled “The admin panel shows a license notice.”Open Add-ons → Manage add-ons → Captcha Pro: the License card at the top says what is wrong. Fix it on the License tab and click Check now. See License.
Does the add-on work on my staging copy?
Section titled “Does the add-on work on my staging copy?”Yes. Subdomains of your licensed domain and local development hosts (localhost, private IP addresses, *.local, *.test) are covered by the same license. Turnstile and hCaptcha site keys must list the staging domain too.
What happens if your license server is down?
Section titled “What happens if your license server is down?”Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days is it switched off until the next successful check.
Does the license check slow down my storefront or checkout?
Section titled “Does the license check slow down my storefront or checkout?”No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse or check out.
Still stuck?
Section titled “Still stuck?”Work through the troubleshooting guide, then contact support with your CS-Cart version, edition, PHP version and the add-on version (1.0.0).