mathguard for TYPO3

Math CAPTCHAs are the low-barrier spam protection most websites have never heard of

Spam in contact forms is a constant headache. The most popular solution is Google reCAPTCHA, which sends user data to Google and complicates GDPR compliance. Image-based CAPTCHAs (“Select all squares with traffic lights”) frustrate users and are inaccessible to screen readers. mathguard takes a different route: the extension shows a simple arithmetic problem (“What is 3 + 7?”) in the form. Humans solve it in seconds, while most automated bots fail. No external JavaScript, no cookies, no data transfer to third parties.

For public bodies, universities and companies with accessibility requirements (WCAG 2.1 under the EU Web Accessibility Directive, implemented in Germany as BITV 2.0), a math CAPTCHA is one of the few CAPTCHA types without image puzzles, provided the problem appears as text in the form. It blocks 85 to 95% of incoming bot traffic. For comparison: Google reCAPTCHA v3 achieves similar rates but transfers data to Google servers on every page view, even when nobody touches a form.

Typical use cases are contact forms, comment sections and registrations

The standard scenario is the contact form on a corporate website. Without spam protection, 20 to 200 bot submissions a day land in the editorial team’s inbox. mathguard adds an arithmetic field placed between the email field and the submit button. The problem is generated randomly on every page view, so bots cannot precompute the answer.

The second scenario is comment sections on blogs and news pages. As soon as visitors can comment on articles, spam is unavoidable. mathguard protects the comment form without visitors needing a Google account or a special app.

The third scenario is user registration. If a website offers frontend accounts, for example for a customer portal or a protected download area, mathguard protects the registration form against automated account creation. The arithmetic problem is the last hurdle before submission, on top of double opt-in.

The technical architecture generates server-side arithmetic problems with hash validation

mathguard works entirely server-side. Every time a form is loaded, the extension generates a random arithmetic problem: the sum of two numbers from 0 to 9. The answer is not in the form as plain text; a hidden field holds an MD5 hash of the result, the current hour and a fixed number, and on submission mathguard compares the hash of the input against it. The method needs no session and no cookie.

Integration into TYPO3 forms works through a PHP interface: a form extension calls getCaptcha() to output the problem and validateCaptcha() to check the answer. The question text and color can be adjusted via TypoScript. The extension, which dates from 2009, does not come with ready-made integrations or examples for powermail and the TYPO3 Form Framework; the Form Framework did not exist back then.

mathguard draws the problem as a small graphic made of random characters in a <pre> block, not as readable text. Screen reading software therefore reads out only a string of characters; a math CAPTCHA only becomes screen reader friendly when the problem appears as text in the form. Even then, any arithmetic problem remains a hurdle for people with dyscalculia, as the W3C points out explicitly.

For extra security, mathguard can be combined with a honeypot field: an invisible form field that bots fill in but real users never see. Timestamp validation adds another layer: if a form is completed in under 3 seconds, it is very likely a bot. The combination of math CAPTCHA, honeypot and timestamp check reduces spam by more than 99%.

Common problems are clever bots, the change of the hour and irritated users

Problem one: advanced bots that solve arithmetic problems. Simple text-parsing bots can interpret “What is 3 + 7?” and enter the correct answer “10”. The fix: present the problem as lightly obfuscated text (“Three plus seven makes?”) or wrap it in context (“How many legs does a chair have, minus one?”). In its default configuration, mathguard uses numeric problems, which is enough for 85 to 95% of bots.

Problem two: the change of the hour. Because the current hour goes into the hash, validation fails if the hour changes between loading and submitting the form, even though the user entered the right answer. The fix: adapt the validator so that it also accepts the hash of the previous hour.

Problem three: irritated users. Some visitors find an arithmetic problem condescending (“Do I really have to prove I can add?”). The fix: place a friendly note above the field (“Spam protection: please solve this quick problem”) and integrate the problem unobtrusively into the form design.

The technology is minimal, but the extension itself dates from 2009

The extension has no deep API dependencies on the TYPO3 core: problem, hash and check are a few lines of standard PHP. Its latest version, 1.0.0, dates from 2009, however, and according to the TER it supports none of the TYPO3 versions maintained today. For projects that want to do without the extension entirely, the same logic can be rebuilt as a custom validator in the TYPO3 Form Framework or as a powermail finisher in under an hour. In its own projects, Gosign implements a combination of honeypot, timestamp validation and an optional math CAPTCHA as three-stage spam protection that needs no external services and stops more than 99% of automated attacks. Whether the math CAPTCHA is always visible or only kicks in as a hidden fallback is decided per project, based on the expected spam volume and the accessibility requirements.