---

Integrating ALTCHA into Joomla Core: Finding the Sweet Spot Between Reusability and Flexibility

Integrating an anti-spam solution into an established CMS is not just a matter of choosing an algorithm. The real challenge is finding a solution that works reliably across a wide variety of websites while fitting naturally into the CMS architecture, remaining maintainable, and providing a good experience for both site visitors and administrators.

For Joomla, ALTCHA proved to be a particularly good fit.

Beyond choosing a CAPTCHA solution

Joomla is used for everything from small personal websites to complex business applications and large, highly customised installations. A built-in anti-spam solution therefore needs to be more than a working demo: it must be adaptable to different use cases without introducing unnecessary dependencies or imposing a rigid integration model.

The decision to bring CAPTCHA functionality back into Joomla Core was an opportunity to provide a consistent, readily available solution while avoiding the need for every website to install and maintain a separate extension. Privacy, usability, and long-term maintainability were important considerations.

ALTCHA's proof-of-work approach also offered a different user experience from traditional CAPTCHAs. Instead of asking visitors to solve visual puzzles, the browser performs a computational challenge in the background.

Integration without fighting the framework

One of the most positive aspects of the implementation was how straightforward it was to integrate ALTCHA's frontend and backend libraries.

Both sides provide useful functionality out of the box, while leaving enough room to adapt the implementation to the requirements of the surrounding application. This is an important distinction: a library should solve the problems that are common across applications, but it should not dictate how the entire host system must work.

For Joomla, this flexibility made it possible to integrate ALTCHA into the existing architecture rather than building a parallel mechanism around it.

Even Joomla-specific requirements fitted naturally into this model. One example was the need to configure internationalisation strings dynamically at runtime. Rather than requiring an awkward workaround or changes to the underlying library, this could be handled as part of the integration.

This may sound like a small detail, but these are precisely the kinds of issues that determine whether a third-party library is genuinely pleasant to work with in a real-world application. An integration can be technically possible yet remain cumbersome if the library makes assumptions about its environment. ALTCHA avoided much of that friction.

The right balance of abstraction and control

A particularly valuable lesson from the project is the importance of finding the right level of abstraction.

A library that leaves everything to the integrating application offers flexibility, but little practical help. At the other extreme, a library that makes too many architectural decisions can be difficult to integrate into an established system.

ALTCHA struck a good balance for this project. It provides the core functionality needed for proof-of-work challenges and their verification, without preventing Joomla from handling integration-specific concerns in its own way.

That balance also supports maintainability. Keeping the integration concerns separate from the underlying anti-spam mechanism makes it easier to adapt the implementation as Joomla evolves. It also helps preserve the option of replacing the underlying solution in the future, rather than making a particular implementation an inseparable part of the CMS architecture.

For a long-lived open-source project, this independence matters. The goal is not merely to integrate a library successfully today, but to avoid creating unnecessary constraints for future maintainers.

Feedback beyond the implementation itself

The feedback so far has been very encouraging. The Joomla community response has been positive, and accessibility reviewers have also praised the implementation.

That feedback is particularly valuable because an anti-spam mechanism sits at the intersection of security and usability. A solution that protects forms but creates barriers for legitimate visitors would only solve part of the problem.

Proof-of-work removes the need for traditional interactive CAPTCHA puzzles, although it does not eliminate every accessibility or compatibility consideration. The overall implementation still needs to work well within the host application's forms, translations, and user interface.

The positive feedback suggests that the approach is moving in the right direction, while also reinforcing the importance of evaluating the complete integration rather than the underlying technology alone.

Lessons for other open-source projects

If there is one lesson from this experience, it is that successful integrations depend as much on the quality of a library's interfaces as on the functionality it implements.

Before adopting a third-party component, it is worth asking not only whether it provides the required features, but also whether it allows the host application to retain control over its own architecture, conventions, and user experience.

In our case, ALTCHA provided exactly that combination: enough functionality to avoid reinventing the wheel, and enough flexibility to make the integration feel like a natural part of Joomla.

That is the sweet spot we should look for when bringing external technology into an established open-source project.

---

Author: David Jardin, Joomla Core Team
Published: 05/11/2026