Re Captcha on contact us.

[Steve G Griggs]

Just a small point.
Why is the re-captcha enabled by default on the contact us form in V11.
This threw me a bit as I knew I hadn't set up captcha on the contact form, and couldn't understand why a form submission sent an error back saying the captcha had not been completed, when I hadn't set anything up.
Surely something like this should only be enabled if you are using the service?

[KerryG]

Contact us error

Always reassuring when someone else hits the same problem - had no idea what was going on

[nsparrow]

Captch

I'm upgrading now to v11 because the captcha removes the security flaw in previous versions. My site has gotten hacked twice in 2 weeks by someone adding php script on my site to send out spam and almost crashing my hosts servers. I didn't use the contact us form on that site, but the script was still out there and vulnerable. I have to go remove the mf00001.pl file from cgi-bin every time I update the site until I install the upgraded version this weekend.

[brucet]

Ordinarily the software doesn't enable new features by default when upgrading sites. In the case of reCaptcha, though, it's widely recognised and widely adopted on web sites generally, because it closes a well known loophole which is frequently exploited by spammers. So in this case we felt it better to enable it by default. Mainly my decision - sorry for any confusion caused.

[Mike Hughes]

It sounds like a good decision to me Bruce.

It would probably be good to include a note about changes like this in the 'changes' section of the release notes. That way a quick read of the changes will bring everyone up to speed and avoid anyone being caught by surprise.

Mike