How To Configure BotDetect ASP Classic CAPTCHA Options

BotDetect Classic ASP Captcha allows detailed customization of many Captcha properties, both through the custom BotDetect\CaptchaConfig.asp configuration file and ASP form source code.

Beside the explanations on this page, you can also see how various Captcha properties have been set in the Captcha options sample projects included in the BotDetect installation. You can reuse the sample source code that fits your application requirements.

BotDetect CAPTCHA ASP Configuration Mechanisms

BotDetect Captcha properties can be set in several different ways, depending on the type of value you are customizing.

Captcha ASP Library Configuration File

When you copy the BotDetect ASP Captcha library to your ASP application folder, you can edit the BotDetect\CaptchaConfig.asp file. This file contains global BotDetect settings which apply to all Captcha object instances in the application.

This is the preferred method of Captcha configuration if you are only placing Captcha protection on one form in the ASP application, or you want Captcha instances on separate forms to all use the same settings.

For example, to set Captcha image style and code length, you would make the following changes in the BotDetect\CaptchaConfig.asp file: 
' Captcha code configuration
' ---------------------------------------------------------
LBD_Configuration_CodeLength = 4
  
  ...
  
' Captcha image configuration
' ---------------------------------------------------------
LBD_Configuration_ImageStyle = LBD_ImageStyles("Lego")

[back to top]

Captcha ASP Object Instance Properties

This option is suitable if you want to place Captcha protection on multiple forms in the same ASP application, but have them use different, mutually incompatible Captcha settings (for example, a Captcha code length of 6 for the registration form Captcha, and a Captcha code length of 3 for the comment form Captcha).

The use of this option should be carefully considered and used sparingly, as the parameter values set this way have to be persisted in ASP Session state. Besides consuming additional server memory for each visitor, this option is also less reliable than the global settings (since they won't apply to users with expired Sessions or disabled cookies).

For example, to set Captcha image style and code length, you would specify them in your ASP form code after the Captcha object has been initialized and before it's added to the page: 
<% ' Adding BotDetect CAPTCHA to the page 
Dim SampleCaptcha : Set SampleCaptcha = (New Captcha)("SampleCaptcha")
SampleCaptcha.UserInputID = "CaptchaCode"
SampleCaptcha.ImageStyleName = "Lego"
SampleCaptcha.CodeLength = 4
Response.Write Captcha1.Html %>

[back to top]

BotDetect Enumerated Captcha Values

The COM component interface underlying the BotDetect Captcha ASP library takes integer parameters as enumerated values – for example, the Captcha image style in the COM interface is represented as an integer between 0 and 49.

However, this doesn't mean that you have to use (hard to read) integer values in your code, since the BotDetect ASP Captcha library includes some helpers which can convert enumerated value names to their numeric representations.

For example, the Captcha COM component only understands "0" as the Chess image style, but the Captcha library also includes the LBD_ImageStyles dictionary, which converts the (case-insensitive) image style name to the equivalent numeric value.

So the following two statements are equivalent: 
LBD_Configuration_ImageStyle = 0

LBD_Configuration_ImageStyle = LBD_ImageStyles("Chess")

Other equivalent helpers implemented are: LBD_CodeStyles, LBD_SoundStyles, LBD_ImageFormats and LBD_SoundFormats.

Furthermore, when setting Captcha object properties, each enumerated parameter can be set by either the numeric or the string property accessor.

For example, the following two lines are equivalent: 
SampleCaptcha.SoundStyle = 0

SampleCaptcha.SoundStyleName = "Dispatch"

This allows you to keep your ASP code using BotDetect Captcha protection easier to read.

[back to top]

Captcha Settings Randomization

Randomizing Captcha properties such as image style and code length significantly improves Captcha security, since any automated analysis first has to determine how many characters are in each generated Captcha image or sound, and which of the many obfuscation methods was used.

You can see this approach to BotDetect Captcha property setting implemented in the Captcha randomization sample project coming with the BotDetect installation.

Captcha properties can be randomized whether you are setting them in the BotDetect configuration file or object instance properties. The BotDetect ASP Captcha library includes the LBD_RandomFromRange(lowerLimit, upperLimit) and LBD_RandomFromValues(values) functions, which you can use in your code:

' code length randomization
LBD_Configuration_CodeLength = LBD_RandomFromRange(4, 6)

' image style randomization
Dim imageStyleNames(8)
imageStyleNames(0) = "Lego"
imageStyleNames(1) = "MeltingHeat"
imageStyleNames(2) = "Ghostly"
imageStyleNames(3) = "Fingerprints"
imageStyleNames(4) = "Graffiti2"
imageStyleNames(5) = "Bullets2"
imageStyleNames(6) = "CaughtInTheNet2"
imageStyleNames(7) = "Collage"
imageStyleNames(8) = "Chalkboard"
LBD_Configuration_ImageStyle = _ 
  LBD_ImageStyles(LBD_RandomFromValues(imageStyleNames))
  
' sound style randomization
LBD_Configuration_SoundStyle = _ 
  LBD_SoundStyles(LBD_RandomFromValues(LBD_SoundStyleNames))

As you can see, you can reference the full list of enumerated values (if you want to randomly select from all available options) using the following arrays: LBD_CodeStyleNames, LBD_ImageStyleNames and LBD_SoundStyleNames.

[back to top]

How to Use BotDetect Captcha Control Internationalization

BotDetect 3 supports Captcha localization, using character sets and sound pronunciation languages appropriate to the active locale setting. Locale strings can be set through the Locale property. For example, you can set the Captcha locale in the BotDetect configuration file:

' Canadian French
LBD_Configuration_Locale = "fr-CA"

Locale strings can specify the language (for example en, ru, cmn, ...), charset (for example jp-Hira uses Japanese Hiragana characters, while jp-Kana uses Japanese Katakana characters) and country (for example en-US and en-GB differ in the pronunciation used).

For this to work, you have to choose a locale combination supported by BotDetect, and copy the appropriate pronunciation sound package to the BotDetectSounds subfolder of your BotDetect ASP installation.

Depending on your OS version and the locale you want to use, you also might have to install the appropriate Windows localization package, containing fonts supporting the required non-latin characters.

[back to top]

BotDetect CAPTCHA Code Settings

BotDetect exposes a number of settings which affect the randomly generated Captcha codes.

CAPTCHA Code Style

Captcha code style is usually set in the BotDetect configuration file. 
LBD_Configuration_CodeStyle = LBD_CodeStyles("Alpha")

[back to top]

CAPTCHA Code Length

Captcha code length is usually set in the BotDetect configuration file, and it's recommended that you randomize it(since it makes Ocr significantly harder). 
LBD_Configuration_CodeLength = LBD_RandomFromRange(4, 6)

[back to top]

Custom CAPTCHA Code Character Sets

The character set used to generate BotDetect Captcha codes can also be customized, via the LBD_Configuration_CustomCharset value: 
LBD_Configuration_CustomCharset = "A,B,C,D,1,2,3"

[back to top]

CAPTCHA Code Timeout

Captcha codes can be set to expire after a user-defined period (in seconds): 
LBD_Configuration_CodeTimeout = 300

This setting is usually paired with the auto-reloading setting.

[back to top]

Generated CAPTCHA Code Filtering

BotDetect also allows you to filter certain unwanted sequences from randomly generated Captcha codes. This is useful for keeping your Captchas free of swear words and other potentially undesirable values. You can see how this works in the Captcha code filtering sample project included in the BotDetect installation.

Since Captcha codes are generally short (usually between 3 and 8 characters long), it doesn't make sense to use a list of actual banned words, but simple "banned character sequences" which cover multiple undesirable values. For example, to prevent the random generator from using both "man" and "manners" in Captcha codes, it's enough to ban the "man" sequence.

LBD_Configuration_BannedSequences = "aa,bb,cc"

[back to top]

BotDetect CAPTCHA Image Settings

BotDetect exposes a number of settings which affect Captcha image generation.

CAPTCHA Image Style

It's best to randomize the BotDetect Captcha image style, since that option provides the highest Captcha image security. You can choose a set of image styles that will randomly be used: 
Dim imageStyleNames(8)
imageStyleNames(0) = "Lego"
imageStyleNames(1) = "MeltingHeat"
imageStyleNames(2) = "Ghostly"
imageStyleNames(3) = "Fingerprints"
imageStyleNames(4) = "Graffiti2"
imageStyleNames(5) = "Bullets2"
imageStyleNames(6) = "CaughtInTheNet2"
imageStyleNames(7) = "Collage"
imageStyleNames(8) = "Chalkboard"
LBD_Configuration_ImageStyle = _ 
  LBD_ImageStyles(LBD_RandomFromValues(imageStyleNames))

[back to top]

CAPTCHA Image Size

BotDetect Captcha image size is best set in the BotDetect ASP configuration file: 
LBD_Configuration_ImageWidth = 200
LBD_Configuration_ImageHeight = 50

[back to top]

CAPTCHA Image Format

Since the Captcha image format won't change for different Captcha object instances, you can set it in the BotDetect ASP configuration file: 
LBD_Configuration_ImageFormat = LBD_ImageFormats("Png")

[back to top]

CAPTCHA Image Custom Color Scheme

BotDetect allows color scheme customization though two color points: a custom dark color and a custom light color. Since many Captcha drawing styles randomize the actual color used, the user-defined values are used as randomization starting points instead of absolute values.

Furthermore, since some drawing styles use light text on a dark background, while other draw dark text on a light background, text and background colors are not set directly, but are referred to as simply the "dark" and the "light" color. This allows you to randomize the image drawing style, for example, and still keep a consistent color scheme adjusted to your website design.

The color are specified as Html color values, so you can use both predefined color names and custom color hex values. For example, you would use: 
LBD_Configuration_CustomDarkColor = "SeaGreen"
LBD_Configuration_CustomLightColor = "#9966FF"

[back to top]

CAPTCHA Image Tooltip & Help Link

The Captcha image tooltip / alt text can be customized, and the Captcha image can also be a link leading to a Captcha help page:

LBD_Configuration_ImageTooltip = "CAPTCHA"
LBD_Configuration_HelpLinkEnabled = True
LBD_Configuration_HelpLinkUrl = "http://captcha.biz/captcha.html"

[back to top]

BotDetect CAPTCHA Sound Settings

BotDetect exposes a number of settings which affect Captcha sound generation.

CAPTCHA Sound Style

BotDetect Captcha sound style is best randomized for highest Captcha sound security. You can choose a set of sound styles that will randomly be used: 
Dim soundStyleNames(2)
soundStyleNames(0) = "Dispatch"
soundStyleNames(1) = "Radio"
soundStyleNames(2) = "Synth"
LBD_Configuration_SoundStyle = _ 
  LBD_SoundStyles(LBD_RandomFromValues(soundStyleNames))

[back to top]

CAPTCHA Sound Format

Since the Captcha sound format won't change for different Captcha object instances, you can set it in the BotDetect ASP configuration file: 
LBD_Configuration_SoundFormat = LBD_SoundFormats("WavPcm8bit8kHzMono")

[back to top]

Disabling CAPTCHA Sound

Captcha sounds can be disabled entirely in the BotDetect ASP configuration file: 
LBD_Configuration_SoundEnabled = False

[back to top]

CAPTCHA Sound Package Settings

Settings related to BotDetect sound packages apply to the whole application, and can be changed in the BotDetect ASP configuration file.

Sound Package Location

Instead of the BotDetect installation folder, your application can read the BotDetect pronunciation sound packages from a custom location as well. You just have to ensure the IIS worker process running your ASP application has permission to access the location, and specify it as: 
LBD_Configuration_SoundPackageFolder = "C:\Websites\BotDetectSounds"

Missing Sound Package Behavior

When BotDetect can not find the pronunciation sound package required for the current locale settings, a warning is displayed by default. This helps during development and deployment, so you don't mistakenly forget to copy the needed files.

However, this warning is not meant for site visitors, so if you didn't copy a particular sound package because you don't want to support Captcha sounds in that language, you can disable the warning (and the sound icon for such locales) by specifying: 
LBD_Configuration_WarnAboutMissingSoundPackages = False

[back to top]

CAPTCHA Sound Icon

BotDetect allows you to use a custom sound icon, which can be specified as an application-relative or an absolute Url. The default icon size is 22 x 22 pixels. You can specify your own sound icon tooltip as well: 
LBD_Configuration_SoundIconUrl = "CustomSoundIcon.gif"
LBD_Configuration_SoundTooltip = "Speak the CAPTCHA code"

[back to top]

BotDetect CAPTCHA Reloading Settings

BotDetect exposes a number of settings which affect Captcha reloading behavior.

Disabling CAPTCHA Reloading

Captcha reloading can be disabled entirely in the BotDetect ASP configuration file: 
LBD_Configuration_ReloadEnabled = False

[back to top]

CAPTCHA Reload Icon

BotDetect allows you to use a custom reload icon, which can be specified as an application-relative or an absolute Url. The default icon size is 22 x 22 pixels. The reload icon tooltip can be customized as well: 
LBD_Configuration_ReloadIconUrl = _ 
  "http://captcha.biz/images/refresh.png"

LBD_Configuration_ReloadTooltip = "Speak the CAPTCHA code"

[back to top]

CAPTCHA Automatic Reloading

Captcha images are automatically reloaded when the Captcha code expires, but only within a certain interval from their first generation.

This allows you to have a short Captcha code timeout (e.g. 5 minutes) to narrow the window of opportunity for Captcha reusing on other sites or human-solver-powered bots, and actual visitors can still fill out your form at their own pace and without rushing (since the Captcha image will be reloaded automatically when it is no longer valid).

Since we don't want infinite sessions when the user leaves the form open in a background browser tab over the weekend (for example), you should also set a reasonable upper limit on the auto-reload period (e.g. 2 hours = 7200 seconds). 
LBD_Configuration_AutoReloadExpiredCaptchas = True
LBD_Configuration_AutoReloadTimeout = 7200

[back to top]

BotDetect CAPTCHA Web Settings

BotDetect exposes a number of settings which affect the Captcha Html markup, client-side behavior, and Http behavior.

CAPTCHA User Input Processing

The Captcha user input textbox client ID should be registered for each Captcha instance in your ASP forms: 
Dim SampleCaptcha : Set SampleCaptcha = (New Captcha)("SampleCaptcha")
SampleCaptcha.UserInputID = "CaptchaCode"
Several client-side behaviors are enabled by default when this is done, which can optionally be disabled in the BotDetect ASP configuration file: 
LBD_Configuration_AutoFocusInput = True
LBD_Configuration_AutoClearInput = True
LBD_Configuration_AutoLowercaseInput = True

autoLowercase

Anything the users type in the input textbox will be lowercased on the fly, since Captcha validation is not and should not be case-sensitive. This is a small usability improvement that helps communicate that fact to the users clearly.

autoClear

The input textbox will be cleared on all Reload icon clicks and auto-reloads, since any previous input in the textbox will be invalidated by Captcha reloading. This is a small usability improvement that helps users avoid having to delete the previous input themselves.

autoFocus

The input textbox will be assigned focus on all Captcha Sound and Captcha Reload icon clicks, allowing the users to more easily type in the code as they hear it or as the new image loads. This does not apply to auto-reloading of expired Captchas, since the user might be filling out another field on the form when the auto-reload starts and shouldn't be distracted.

[back to top]

CAPTCHA Tabindexes

You can set the starting tabindex used for Captcha Html elements through a Captcha object instance property: 
Dim SampleCaptcha : Set SampleCaptcha = (New Captcha)("SampleCaptcha")
SampleCaptcha.TabIndex = 12

There are three keyboard-selectable Captcha markup elements: the Captcha image help link, the Captcha sound icon and the Captcha reload icon.

Depending on your settings (whether the Captcha help link is enabled, are Captcha sounds enabled, is Captcha reloading enabled), the next available tabindex on the page can be from 0 to 3 greater than this value.

[back to top]

CAPTCHA CSS Styles

Default BotDetect CSS declarations can be found in the BotDetect/Layout.css stylesheet included from the Captcha library folder copied to your ASP website. If you want to expand or modify the CSS style declarations used, you can simply edit the deployed stylesheet.

[back to top]

CAPTCHA Client-Side Events

BotDetect includes a custom client-side event system, allowing you to specify your own client-side handlers for certain BotDetect actions.

For example, you would add your handler to the BotDetect.PostReloadImage client-side event by using: 
BotDetect.RegisterCustomHandler('PostReloadImage',
  function() {
    // your code goes here
  }
);

[back to top]

CAPTCHA Persistence

By default, BotDetect uses ASP Session state to store generated Captcha codes for validation. If you want to use a more reliable server-side storage mechanism (e.g. SQL database persistence), you have to wrap it in an ASP object supporting dictionary-like access by name (as ASP Session state does). You can then configure BotDetect to use it by editing the default declaration:

Dim LBD_Persistence : Set LBD_Persistence = Session

[back to top]

language: English
  • English English

© Lanapsoft, Inc. 2004-2012. All rights reserved.

BotDetect, BotDetect CAPTCHA, Lanap, Lanap CAPTCHA, Lanap BotDetect, Lanap BotDetect CAPTCHA, Lanapsoft, Lanapsoft CAPTCHA, Lanapsoft BotDetect, Lanapsoft BotDetect CAPTCHA, and Lanap Software are trademarks of Lanapsoft, Inc. All other product, brand, and company names are mentioned for identification purposes only and are trademarks or registered trademarks of their respective owners.