CAPTCHA in Joomla 6: reCAPTCHA is gone

Joomla used to bundle CAPTCHA plugins for Google reCAPTCHA v2 and v3, and most tutorials still say so. Look in the plugin list of a clean Joomla 6 install and you will find one CAPTCHA plugin: powCAPTCHA.

What powCAPTCHA does differently

It is a proof-of-work challenge. The visitor's browser is given a small computation to complete before the form submits. No images of traffic lights, no clicking, and nothing sent to a third party about who the visitor is.

For a site that has to answer questions about tracking and consent, that difference matters. A reCAPTCHA on your contact form is a Google request on every page that carries the form, which is a conversation you then have to have with whoever handles your privacy statement.

Turning it on

Enable the CAPTCHA - powCAPTCHA plugin. Its options are the useful part:

• Difficulty decides how much work the browser does. Higher means more of a barrier for a bot and a longer wait for a visitor on an old phone. Start low.
• Autosolve starts the work when the form loads rather than on submit, so by the time someone has finished typing it is already done. Leave it on unless you have a reason.
• Expiration controls how long a solved challenge stays valid.

Then set it as the site default in Global Configuration, on the Site tab, where the Default CAPTCHA option lives. Individual forms can still choose their own.

Where to apply it

User registration and the contact form are the two that get hit. Login forms usually do not need one, and adding a CAPTCHA there mostly annoys the people who belong on your site. Rate limiting is a better answer for login abuse.

If you still need reCAPTCHA

It is available as a separate extension. Before you install it, be honest about whether you need it, or whether you are installing it because a five-year-old tutorial said to.