Connect Yandex SmartCaptcha

Lesson 10 / 22 · Commentail 1.3.2

Use Yandex SmartCaptcha's standard widget. Replace the Google backend from the previous lesson; only one backend is selected.

Create a practice resource

In Yandex Cloud select the cloud and folder for your experiment, open SmartCaptcha and create a dedicated CAPTCHA. Configure actual allowed domains using the creation guide. Check billing conditions and account quotas first. Keep domain validation enabled.

Obtain the resource's client and server keys. The client key becomes CAPTCHA_SITE_KEY; the server key becomes CAPTCHA_SECRET_KEY. Follow lesson 5 and substitute your values for the placeholders.

Configure the application

Merge this into the existing settings dictionary:

import os

# Merge into the existing COMMENTAIL["default"] dictionary.
COMMENTAIL = {
    "default": {
        "CAPTCHA_BACKEND": "commentail.captcha_providers.YandexSmartCaptcha",
        "CAPTCHA_OPTIONS": {
            "site_key": os.environ["CAPTCHA_SITE_KEY"],
            "secret_key": os.environ["CAPTCHA_SECRET_KEY"],
            "timeout": 3,
        },
    },
}

Restart and run python manage.py check. For a local setup, verify that the provider permits the domain and that the Wagtail Site matches the actual address. The Yandex adapter checks the exact response host, including a nondefault port; a proof from another address does not match.

Commentail mounts the widget when forms appear and when replying. Load {% commentail_js %} in the base template without adding another SmartCaptcha loader.

Test loading and submission

In a private window fill in the form, solve the challenge and submit. Check a missing answer and retry after failure. Adaptive mode may exempt a confirmed guest; use a fresh session or temporarily set GUEST_CAPTCHA_MODE to "always".

If the widget is missing, inspect browser Console and Network for script loading, CSP and content blockers. Obtain script/frame/connect requirements from current provider documentation; do not disable CSP. The secret key must never appear in browser code.

Provider failure denies verification. Keep the draft and retry later; there is no automatic arithmetic bypass. External widgets require JavaScript. The local binding follows FORM_TICKET_SECONDS, one hour by default, while the provider independently checks its token expiry.

To finish, switch back to arithmetic (CAPTCHA_BACKEND: None) or configure the production resource, then delete only the practice CAPTCHA from its folder. Removing a test resource does not require deleting a cloud or shared infrastructure.

Related lessons

• 5. Environment variables without key confusion
• 9. Connect Google reCAPTCHA
• 11. Word rules, CSV and spam protection

Related documentation

• Callbacks
• Security-and-privacy