My new TYPO3 extension "powermail_crshield" is available
Back in July 2022, I released the TYPO3 extension form_crshield, a lightweight solution that adds a challenge/response layer to TYPO3 forms created with ext:forms to protect them from automated spam submissions. Since then, the extension has been downloaded more than 140,000 times, proving that the approach works well for many TYPO3 integrators and projects.
Building on the same concept, I’ve now developed a similar extension for ext:powermail, one of the most popular TYPO3 form extensions. The new extension is called powermail_crshield, provides the same JavaScript-based challenge/response mechanism for Powermail forms and is available for TYPO3 version 12.4 and 13.4.
How it works
The challenge/response spam shield adds a hidden input field to every form generated by the TYPO3 Powermail extension.
This input field contains a pre-calculated value with a unique challenge. A small JavaScript snippet included in the
page uses that challenge to compute the expected response, which is then validated when the form is submitted.
If the expected response is missing or incorrect, validation for the hidden field fails — and no email is sent.
Installation and configuration
Installation is straightforward: install the extension via the Extension Manager or Composer and enable the protection in your TypoScript setup. A detailed description and configuration examples are available in the README on GitHub.
A note on spam protection
As with any spam protection technique, there’s no 100% guarantee that spam will never slip through. Bots with JavaScript support or those that specifically reverse-engineer the protection mechanism might still manage to submit forms. However, such cases are considered very unlikely, as the required effort for attackers is typically too high compared to the potential “benefit”.
Feedback
Bug reports, feature requests, or new ideas for improvements are always welcome. Please use the GitHub issue tracker to share your feedback or suggestions.