Bot Manager requires a captcha to function. You can use Google reCaptcha v2, hcaptcha or the Image Captcha mod. Two things that may influence your decision are price and protection. Google reCaptcha and hcaptcha offers a higher levels of protection using background analysis and user interaction to differentiate bots from humans. Image Captcha is free and relies on differentiating multiple images but has no background analysis for user interaction.
The first 10,000 Google reCaptcha verifications are free. The first 100,000 hcaptcha verifications are also free.Important: If you exceed Google's free 10,000 verification limit within a thirty day period, and billing is not enabled, Google will return an error.
The same is true for hcaptcha after reaching 100,000 verification limit within a thirty day period, and billing is not enabled, hcaptacha will return an error.
When you reach the limit, you will be unable to login to your website until the first of the month, unless the ALLOW LIMITED ACCESS option is true and REQUIRE CAPTCHA TO LOGIN is false.
More information on the Google pricing structure can be found at Google pricing. To obtain Google reCaptcha keys your website must be registered with Google. If your website is not registered with Google click here: Google Getting Started. If your site is registered with Google, obtain reCaptcha keys by clicking here: Create Google reCaptcha keys
Information on the hcaptcha pricing structure can be found at Hcaptcha Pricing. Registering a website with hcaptcha and obtaining API keys is easier than Google and can be found at Hcaptcha Sign Up Options. If you decide to use hcaptcha, the TNG mod can be found here haptcha.
Bot Manager requires one of the following Google reCaptcha v2, hcaptcha or the Image Captcha mod. If Google reCatcha or hcaptcha is used, API keys must be entered before installing Bot Manager.
When installing with Google reCaptcha, the site key and secret key must be stored in the TNG config.php file using the Admin->General Settings->Privacy panel. If you enter the keys in customconfig.php,
Bot Manager will NOT install with Google reCaptcha.
The Bot Manager captcha install priority is as follows: 1-Image Captcha, 2-hcaptcha, 3-Google reCaptcha.
So if Image Captcha is installed it will be used even if Google reCaptcha keys and hcaptcha is installed. To use Google recaptcha or hcaptcha, do not install Image Captcha.
If hcaptcha is installed, hcaptcha will be used even if Google reCaptcha keys are installed. If Image Captcha or hcaptcha is not installed, Google reCaptcha will be used for the install.
After either Google reCaptcha v2, hcaptcha API keys or the Image Captcha mod has been installed, upload the Bot Manager cfg file and Bot Manager folder to the TNG mods folder.
If there are no errors, Click "OK to install" to expand the Bot Manager mod section. Mod Manager will indicate if Google reCaptcha, hcaptcha or Image Captchua will be configured.
If Bot manager cannot detect the API keys or the Image Captcha mod, cannot install with an error message will be displayed.
Bot Manager will display the configuation to be installed immediately after OK to install.
CAPTCHA PAGE: This option is not available when using Image Captcha because showing the header and footer is part of the Image Captcha mod. This option hides the TNG header and footer when using Google reCaptcha or hcaptcha. When true, the page will not show any TNG links or content. Only a page containing the captcha will be displayed.
REQUIRE CAPTCHA TO LOGIN: This option displays a captcha before logging in. When true, forces users to complete a captcha before they can log in even if limited access is enabled. When false and limited access is enabled users can log in without completeing a captcha.
ALLOW LIMITED ACCESS: When true, this option allows access to the home page. Clicking on any other page loads the captcha challenge unless a custom page is created that DOES NOT use tng-begin.php. Bot Manager has no way to detect access to these pages. Setting this option to false will force loading the captcha for any page using tng_begin.php .
ALLOW SELECT BOTS: When this option is true select bots are allowed to index the website. Setting this option to false does not grant any special access. If this option is true a additional option appears listing the names of the bots that are allowed access. Entries in this field can be simple bot names or the complete user agent string. Keep in mind the user agent string can be spoofed by malicious bots.
ENTER NAMES OF PERMITTED BOT(S) - If allow select bots is true this option will appear. Here you can enter a simple bot name or the complete user agent string. Each entry must be separated with a comma.
Bot Manager allows admins to easily switching captchas if a limit is reached. For example if you are using hcaptcha and are nearing the limit, you can uninstall bot manager then install Image Captcha. When Bot Manager is reinstalled, Image Captcha will be used.
To switch back, first uninstall Bot Manager, then uninstall Image Captcha. Once this is completed, reinstall Bot Manager and hcaptcha will be used. To use Google reCaptcha uninstall hcaptcha and Image Captcha.
If you delete the captcha keys or install Image Captcha after installing Bot Manager, a message will appear stating the mod's status. Since Bot Manager can be installed using one of three different captcha methods, please observe any errors or warnings that may appear in mod manager when you make changes. This cfg file allows admins to easily switch from one captcha to another, depending on resources available.
When you install Bot Manager using reCaptcha or hcaptcha and later install Image Captcha, a message will appear stating which Captcha is installed and Image Captcha is disabled. If you install Bot Manager while using Image Captcha and then uninstall Image Captcha first, an error message will appear to reinstall Image Captcaha, then uninstall Bot Manager. If you install Bot Manager while using hcaptcha and then uninstall hcaptcha first, an error message will appear to reinstall hcaptcaha, then uninstall Bot Manager.
When switching from one captcha system to another ALWAYS uninstall Bot Manager first. Failure to uninstall Bot Manager first may corrupt the following TNG files. customconfig.php, tng_begin.php and TNG_captcha.php
If a captcha limit is exceeded and you lose access to your website, disable Bot Manager by deleteing verify_access.php from the TNG root folder.
Deleting the file will disable Bot Manager and produce a warning in the PHP log file, but TNG will function normally allowing access.
Once you have access, login and go to Administration -> Mod Manager. Bot Manager will indicate Partially installed. Select Bot Manager then click the Clean Up button.
DO NOT install Bot Manager and Guardian at the same time. Guardian will override Bot Manager's settings when both are installed. So if both mods are installed, it will render Bot Manager useless.
Displaying the captcha challenge depends on mods settings. If allow limited access option is true, everyone has access to the home page. When the option is false, everyone must pass the captcha challenge to gain access. Once the captcha is solved the user does not need to solve another captcha unless they log out or delete cookies and site information in their browser. So if require captcha to login is true, users will get a captcha to access the login only if they did not solve a captcha to access the website. This can occur if the allow limited access option is true.
When allow limited access is true and a user attempts to load a page that includes tng_begin.php, either reCaptcha, hcaptcha or the Image Captcha will load, depending on which was installed. If hcaptcha or reCaptcha is installed the user may or may not need to solve a challenge. If the Image Captcha mod is installed, users will need to select the image that is different.
Once the captcha is solved, the user will not need to solve another challenge during the session unless they logout or delete all cookies. TNG logout destroys sessions and cookies so if a user logs out, they will need to solve another captcha to continue. If you have custom pages that do not use tng_begin.php, they will not be protected by Bot Manager.
To uninstall Bot Manager, when using Image Captcha, always uninstall Bot Manager first then follow the normal TNG modmanager procedures for unstalling mods.
Bots use headless browsers having no graphical interface. Headless browsers are often used for web scraping, because they can render JavaScript or programmatically behave like a human user, to avoid detection. It is becoming more difficult to detect and stop bad bots. Bots can spoof IP addresses and user-agents, before sending a request. This allows a bot to quickly access your website multiple times, from different IP addresses. Unfortunately this can defeat the Bot Trap Mod because it bans by IP address. The same is true for RIP Prevention Mod, because it relies on multiple fast hits from the same IP address.
I still use RIP Prevention because it is very effective, provided the IP address remains the same.
I also use Bot Trap to ban bots that do not follow robots.txt by trying to index folders they should not access.