nodebb-plugin-spam-be-gone

Anti-spam plugin for NodeBB 4.x with Cloudflare Turnstile and hCaptcha.

This fork removes Google reCAPTCHA support. Human verification is handled by Cloudflare Turnstile and/or hCaptcha, either or both of which can be enabled independently.

Highlights

• ✅ NodeBB 4.x compatible
• ✅ Cloudflare Turnstile and hCaptcha support (no reCAPTCHA), enable one or both
• ✅ Turnstile and/or hCaptcha challenge on registration
• ✅ Optional Turnstile and/or hCaptcha challenge on login
• ✅ Akismet checks for posts/topics
• ✅ StopForumSpam reporting + queue tooling
• ✅ Project Honeypot (http:BL) checks during registration

Compatibility

| Component | Version | |---|---| | NodeBB | ^4.0.0 | | nbbpm compatibility | ^4.0.0 |

Installation (npm)

From your NodeBB root directory:

npm install @arnaudw38/nodebb-plugin-spam-be-gone
./nodebb build
./nodebb restart

Then enable the plugin in:

Admin → Extend → Plugins (or your NodeBB plugin management page)

Configuration

Open:

Admin → Plugins → Spam Be Gone

Cloudflare Turnstile setup

1. Create a Turnstile widget in your Cloudflare dashboard.
2. Copy your Site Key and Secret Key.
3. In the plugin settings, enable Turnstile and paste both keys.
4. Save settings.
5. Rebuild & restart NodeBB if needed.

Turnstile options supported (plugin settings)

• turnstileEnabled
• turnstileSiteKey
• turnstileSecretKey
• loginTurnstileEnabled
• turnstileTheme
• turnstileSize
• turnstileAppearance

hCaptcha setup

1. Create an hCaptcha site in your hCaptcha dashboard.
2. Copy your Site Key and Secret Key.
3. In the plugin settings, enable hCaptcha and paste both keys.
4. Save settings.
5. Rebuild & restart NodeBB if needed.

hCaptcha options supported (plugin settings)

• hcaptchaEnabled
• hcaptchaSiteKey
• hcaptchaSecretKey
• loginHcaptchaEnabled
• hcaptchaTheme
• hcaptchaSize

What changed in this fork

Removed

• ❌ Google reCAPTCHA integration

Added / refactored

• ✅ Cloudflare Turnstile verification (server-side + client-side)
• ✅ hCaptcha verification (server-side + client-side)
• ✅ Cleaner settings handling / flag parsing
• ✅ More robust client injection (idempotent script/widget rendering)
• ✅ Cleanup for modern NodeBB 4.x plugin usage

Migration notes (from reCAPTCHA)

If you were previously using reCAPTCHA in this plugin:

1. Remove old reCAPTCHA keys from the plugin settings (if still present in your DB/config).
2. Create new Cloudflare Turnstile and/or hCaptcha keys.
3. Configure Turnstile and/or hCaptcha settings in the plugin admin page.
4. Test registration and (optionally) login challenge flows.

reCAPTCHA is no longer supported by this fork.

npm publishing checklist (fork maintainers)

Before publishing your fork, update these fields in package.json:

• name (your npm package name / scope)
• version
• repository
• bugs
• homepage

The current values are placeholders (your-scope / your-org) and should be replaced with your actual npm scope and GitHub repository.

Troubleshooting

Turnstile/hCaptcha widget does not appear

• Check that turnstileEnabled and/or hcaptchaEnabled is enabled.
• Confirm your Site Key is valid.
• Ensure your forum domain matches the domain configured in the Cloudflare Turnstile / hCaptcha dashboard.
• Rebuild NodeBB assets (./nodebb build) and restart.

Verification fails on submit

• Confirm your Secret Key is correct.
• Check server connectivity to the Cloudflare Turnstile / hCaptcha verification endpoint.
• Inspect NodeBB logs for plugin validation errors.

Login challenge not showing

• Confirm loginTurnstileEnabled and/or loginHcaptchaEnabled is enabled.
• Verify your active theme/login template is using the plugin hook output correctly.

Development notes

This package is intentionally kept minimal for easier deployment:

• No ESLint/tooling requirements for runtime
• No package-lock.json included in this fork package
• Turnstile + hCaptcha code paths, no reCAPTCHA

License

MIT

Credits

• Original plugin authors/maintainers of nodebb-plugin-spam-be-gone
• Refactor/fork updates for NodeBB 4.x + Cloudflare Turnstile + hCaptcha