nodebb-plugin-spam-be-gone

Anti-spam plugin for NodeBB 4.x with Cloudflare Turnstile (Turnstile-only fork).

This fork removes all reCAPTCHA and hCaptcha support and uses Cloudflare Turnstile only for human verification.

Highlights

• ✅ NodeBB 4.x compatible
• ✅ Cloudflare Turnstile only (no reCAPTCHA / no hCaptcha)
• ✅ Turnstile challenge on registration
• ✅ Optional Turnstile challenge on login
• ✅ Akismet checks for posts/topics
• ✅ StopForumSpam reporting + queue tooling
• ✅ Project Honeypot (http:BL) checks during registration

Compatibility

| Component | Version | |---|---| | NodeBB | ^4.0.0 | | nbbpm compatibility | ^4.0.0 |

Installation (npm)

From your NodeBB root directory:

npm install @arnaudw38/nodebb-plugin-spam-be-gone
./nodebb build
./nodebb restart

Then enable the plugin in:

Admin → Extend → Plugins (or your NodeBB plugin management page)

Configuration

Open:

Admin → Plugins → Spam Be Gone

Cloudflare Turnstile setup

1. Create a Turnstile widget in your Cloudflare dashboard.
2. Copy your Site Key and Secret Key.
3. In the plugin settings, enable Turnstile and paste both keys.
4. Save settings.
5. Rebuild & restart NodeBB if needed.

Turnstile options supported (plugin settings)

• turnstileEnabled
• turnstileSiteKey
• turnstileSecretKey
• loginTurnstileEnabled
• turnstileTheme
• turnstileSize
• turnstileAppearance

What changed in this fork

Removed

• ❌ Google reCAPTCHA integration
• ❌ hCaptcha integration
• ❌ Legacy captcha UI/assets/styles related to those providers

Added / refactored

• ✅ Cloudflare Turnstile verification (server-side + client-side)
• ✅ Cleaner settings handling / flag parsing
• ✅ More robust client injection (idempotent script/widget rendering)
• ✅ Cleanup for modern NodeBB 4.x plugin usage

Migration notes (from reCAPTCHA / hCaptcha)

If you were previously using reCAPTCHA or hCaptcha in this plugin:

1. Remove old keys from the plugin settings (if still present in your DB/config).
2. Create new Cloudflare Turnstile keys.
3. Configure Turnstile settings in the plugin admin page.
4. Test registration and (optionally) login challenge flows.

Old captcha providers are no longer used by this fork.

npm publishing checklist (fork maintainers)

Before publishing your fork, update these fields in package.json:

• name (your npm package name / scope)
• version
• repository
• bugs
• homepage

The current values are placeholders (your-scope / your-org) and should be replaced with your actual npm scope and GitHub repository.

Troubleshooting

Turnstile widget does not appear

• Check that turnstileEnabled is enabled.
• Confirm your Site Key is valid.
• Ensure your forum domain matches the domain configured in Cloudflare Turnstile.
• Rebuild NodeBB assets (./nodebb build) and restart.

Verification fails on submit

• Confirm your Secret Key is correct.
• Check server connectivity to Cloudflare Turnstile verification endpoint.
• Inspect NodeBB logs for plugin validation errors.

Login challenge not showing

• Confirm loginTurnstileEnabled is enabled.
• Verify your active theme/login template is using the plugin hook output correctly.

Development notes

This package is intentionally kept minimal for easier deployment:

• No ESLint/tooling requirements for runtime
• No package-lock.json included in this fork package
• Turnstile-only code path

License

MIT

Credits

• Original plugin authors/maintainers of nodebb-plugin-spam-be-gone
• Refactor/fork updates for NodeBB 4.x + Cloudflare Turnstile