Add ReCAPTCHA to Donation Forms#7

ReCAPTCHA is an often requested feature that we don’t have Core support for and we should to reduce credit card testing and provide support with an easy was to recommend fraud prevention. Stripe also emails us about implementing it when the detect one of our customers are experiencing card testing. Here’s our current snippet: https://github.com/impress-org/givewp-snippet-library/blob/master/form-customizations/implement-recaptcha.php Note: We already have code implementing ReCAPTCHA on the “Access Control” tab so some logic already exists in the plugin to implement this, just not on the donation form itself.

We should also consider supporting reCAPTCHA v3 since it is less invasive than v2.

(Migrated from featureOS: https://givewp.featureos.app/p/add-recaptcha-to-donation-forms)

We tried everything else and had to revert to implementing the reCAPTCHA snippet. Definitely a good thing to be integrated into the plugin. This will make it accessible to more clients.

I would like to add that GiveWP should be able to block donations when 10+ come in the same minute from the same IP Address. There are few circumstances where an organization is getting 10+ donations at the exact same minute.

From Stephanie Lemings via Priority Support2. In our Daily Activity Transaction Report from PayPal Manager, some of the donations that went through had this message listed in the comments: “This inquiry is GiveWP validating the completion of payment BF1P3B8A1001 GiveWP is storing payment BF1P3B8A1001 to the website database for reference.” 3. Is there any way we can block individuals from donating more than three times in the same day or with more than three different cards in the same day? I figure if we can do that, it will slow down fraudsters because they will have to enter new credentials after every three “donations.” I was able to block the email that donated after the fact using some custom php code that you guys made for us once awhile back, but this precaution can only block emails after the fact, and a fraudster could potentially just keep making up emails. If we could somehow block people from giving three times in a single day, maybe this would slow the fraudsters down? 4. Is there a way we can set up alerts when someone donates more than three times in the same day?

Followup from the userI think the fraudster is first hitting the site to “harvest” nonces (there are a lot of response 200 hits on the form earlier in the day) and then later hitting us with those harvested nonces to submit the forms (the 302 responses later in the day). If GiveWP is using WP nonces then that might explain the problem. WP nonces are not really nonces at all in that they can be used multiple times and any time within 24 hours. My guess is that what GiveWP needs to do is devise it’s own more restrictive nonce that (A) is deleted after a single use and (B) is only valid for a short period that someone might have the form on screen, like maybe 20 minutes. If an invalid nonce is submitted with a form, GiveWP could simply echo back the form with the values still filled in but a fresh nonce hidden away and explain to the user that since the form was idle for so long they will have to re-submit it. But I’m sure you all have other ideas too! For now, we’ve added a captcha to the form. But we all know how problematic that can be for donation forms, so we’d love another solution.

Hi Devin, May I ask for a quick update on this? This feature request is currently the highest voted for (from what I can see) of the “planned” and “in progress” ones. It is also linked to an inherent security underlying issue that has been plaguing GiveWP for the past few years (spam donations) and a captcha mechanism would go a long way in preventing / fighting these. Clearly, Akismet, Stop Donor Spam and Cloudflare while helpful, are simply not effective enough. I would argue that the implementation of this further security measure should be catpcha provider agnostic (hcaptcha, reCaptcha, Friendly Captcha etc..), but I would settle for any one of them if this means improving the situation of SPAM donations. Many thanks in advance for the short feedback.

Salim Faour via Priority SupportIssue Description: We’re trying to set up captcha’s on all the donation forms, but if i activate the captcha on the donation forms, it generates a conflict with the captcha of the the contact forms

James McGowan via Priority SupportDonors are trying to use PayPal and getting I am a robot. I have turned off paypal till fixed. We are using Paypal pro with API

v2 reCAPTCHA makes the donor experience terrible, and we really, really would love to have the code snippet updated so that we can implement something like reCaptcha v3 quickly. GiveWP Support’s suggested remedies for “donor spam” (Akismet integration, raise the minimum amounts, Stop Donor Spam, implement Cloudflare) either don’t work at all for us, or there’s another reason we can’t use those solutions. :/

oxygensmith via WP.org ForumsI second the need for a V3 implementation; I think it should come as an option with at least the paid version. But it would really be something if it was across all GiveWP offerings by default.

Ben Meredith one of the customer messages notes that their solution was to “would only accept transactions of $9,000 or more.” So that I can better understand the SPAM donations, is the customer suggesting that someone is testing cards at upwards of thousands of dollars?

Help

Hey folks! We’re revisiting form security soon and will be looking for the best ways to make our forms more secure.

Feel free to comment on this post with your input or drop other suggestions.

kw11 via WordPress.org ForumIt’s clear that your plugin is big enough now that there are sophisticated botnets specifically targeting it for cardscanning operations. Since the attacks are distributed, it can be difficult to control this short of removing payment gateways. I’ve read other posts saying you didn’t like Captcha’s. But these WP Give botnets are effectively DDoS’ing sites like mine even if every single payment fails because of incorrect CVV and Zip. Many payments are attempting to be processed per second. It used to be these card scanners were using the Stripe Checkout for their operations, so I had to disable this feature. But now it appears they are going directly to sites to use the Credit Card form. Stop the Donor Spam is not effective for this security problem and firewalls aren’t generally effective at stopping the payment attempts. This is the third botnet attack. Over time I’ve tightened security, radar rules, firewall rules, made zip code requirements, raised the minimum donation, disabled Stripe Checkout, etc, but it’s not enough. These bots are getting more sophisticated. Is it possible for you to integrate reCAPTCHA v3? This shouldn’t hurt donations (other than potential false positives) as the user doesn’t have to do anything. I suspect the issue will get worse with time (it already has) and I figure at some point you’ll be forced to implement this feature since it’s a major security risk.

I disagree with the implementation of ReCaptcha. Google has made ReCaptcha incredibly unfriendly for non-Chrome users and they plan to charge for the service in future. Cloudflare has moved to hCaptcha which is privacy respecting and does not discriminate between users’ choice of browser. The implementation for hCaptcha is similar to ReCaptcha.

This is important to help prevent SPAM and card testing.