Abuse protection: captcha and signup checks
Two things keep automated signups and password guessing off the platform: a captcha on the public forms, and checks of the address a signup comes from. Both are off until the operator turns them on, under Settings → Abuse protection in the admin panel (corpsuite abuse set).
Captcha
| Choice | What visitors see |
|---|---|
| Built in (proof of work) | Nothing to solve: their browser does a moment of work ("Checking that you are not a robot") before the form is sent. No other company is involved and no cookies are set. |
| Cloudflare Turnstile | Cloudflare's check, usually invisible. Needs a site key and secret key from Cloudflare. |
| hCaptcha | hCaptcha's check. Needs a site key and secret key from hCaptcha. |
Choose where it is shown: signup, team join pages, password reset requests and webmail sign-in (both the password and the two-step code step). Mail apps never see a captcha; lockouts and throttling protect them (see Sign-in security).
- Built-in difficulty (17 by default) sets how much work: each step up doubles it. 17 takes a phone a second or two.
- Each answer works once, for ten minutes, on any of the platform's servers.
- The pages allow Cloudflare's or hCaptcha's scripts only while that provider is chosen; otherwise no third-party script can load.
Checking signup addresses
When someone signs up (not with an invitation link, which is trusted), the address they sign up from is checked with the services you turn on:
- IPQualityScore (needs an API key): a fraud score from 0 to 100, and whether the address is a proxy, VPN or Tor exit. A signup fails at or above Fails from fraud score (85 by default), and for Tor, VPNs or proxies when you tick them. Strictness 0 or 1 gives the fewest false alarms.
- DNS blocklists such as
zen.spamhaus.org. Spamhaus's public lists are free only for small, non-commercial use; use your data feed's zone name otherwise. - StopForumSpam: whether the address is known for spam signups, from confidence 50 by default.
A signup that fails a check either waits for your approval (the default; see approving signups) or is refused. Team join pages refuse in both cases, since they cannot wait. A check that cannot run (the service is down) lets the signup through, and the problem is written to the log.
What the checks found is kept with the account: Signup checks next to the user (corpsuite mailbox signup-checks USER). Check an address in the settings card (corpsuite abuse test ip=203.0.113.5) runs them on any address without signing anyone up.
Network data (IPNetDB)
IPNetDB publishes which network and autonomous system (AS) each address belongs to, as a downloadable .mmdb file; it has no lookup API. Download the prefix database to the server and enter its path (IPNetDB file on the server). Signup checks then show the address's AS number and organisation. Commercial use needs IPNetDB's paid licence; the free licence is for non-commercial use with attribution.
For developers
GET /api/captcha?purpose=signup|join|reset|signin and the captcha field of signup, join, sign-in and reset requests are in api/signup.yaml and api/webmail.yaml; /v1/abuse-settings in api/openapi.yaml.