Page MenuHomePhabricator

Decide: Should the hCaptcha challenge appear in a new panel in the publish dialog?
Closed, ResolvedPublic

Description

Background goal

VisualEditor has a publish dialog after the user presses "Save changes...". Once this dialog appears, we add the disclaimer text ("This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.") and when the user presses "Save changes" again, hCaptcha's bot detection code runs and presents a challenge to approximately 0.1% of human sessions. (There is also a "showcaptcha" AbuseFilter consequence that is used sparingly, and this can also result in a challenge appearing.)

In order to display the visual challenge, we need to resize the publish dialog so that hCaptcha's iframe has enough space to expand into, to present the challenge to the user.

Decided solution

The hCaptcha will appear as an overlay on top of the Publish dialog, a semi-transparent overlay background-color-backdrop-light should be displayed behind the hCaptcha (between the Publish dialog and the hCaptcha), as with other dialogs in the interface.

image.png (2,866×1,452 px, 1 MB)
Captura de pantalla 2026-02-23 a las 15.15.57.png (1,142×1,138 px, 309 KB)
desktopmobile
NOTE: This solution reuses the existing solution in the create account flow and in T407344.

Acceptance criteria

  • Editing team decides what their preference is for how the visual challenge is presented, between the two options listed above

Event Timeline

Next step(s)

  • Editing Engineering and Design to document what (if any) blocking concerns they hold about moving forward with the "Expand the existing Save your changes dialog" approach
  • Assuming editing Engineering and design do not hold blocking concerns about the "Expand the existing Save your changes dialog" approach, name (any) lightweight improvements they think could be made to improve the UX
NOTE: all of the above should be considered with the context that this modified experienced will be shown in ~0.1% of editing sessions.
ppelberg raised the priority of this task from Low to High.Feb 18 2026, 6:30 PM

Sharing 2 possible approaches for presenting hCaptcha in the Publish flow:

Option 1: Overlay above the Publish dialog

Captura de pantalla 2026-02-23 a las 15.15.57.png (1,142×1,138 px, 309 KB)

This is reusing the current hCaptcha behavior in the Create Account flow: when verification is required, the hCaptcha appears as an overlay above the existing content. This solution reuses the existing solution in the create account flow and avoids resizing or restructuring the Publish dialog. However, it could feel like an interruption in the Publish flow.

Option 2: Expand the existing “Save your changes” dialog

Captura de pantalla 2026-02-23 a las 15.16.18.png (1,688×1,148 px, 213 KB)

The hCaptcha iframe is inserted inside the current dialog, and the dialog expands vertically to accommodate it. The dialog change should be visually smooth and the publish button should be disabled until the captcha is completed. This solution reduces friction during publish since it feels like an additional step rather than an interrupting layer.

Re: option 2, should it instead go where the existing captcha would show inside the dialog?

Noting that the solution we are working on for T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor is following the first approach.

image.png (1,012×947 px, 165 KB)

I recommend to reuse this option then if this is being used here, account creation, and probably other places.

This task should discuss the desktop interface, not the MobileFrontend one. (Sorry I didn't catch that earlier.)

This is what we are proposing to do, how does that sound?

image.png (1,898×1,762 px, 933 KB)
See also this internal Slack thread with other videos/options

@kostajh since the hCaptcha is an overlay on top of the Publish dialog, a semi-transparent overlay background-color-backdrop-light should be displayed behind the hCaptcha (between the Publish dialog and the hCaptcha), as with other dialogs in the interface.

@bmartinezcalvo: thank you for updating the task description to include the UX requirements you've helpfully specified for mobile.

Could you please do the same for desktop, per what @kostajh shared in T413354#11739268?

@bmartinezcalvo: thank you for updating the task description to include the UX requirements you've helpfully specified for mobile.

Could you please do the same for desktop, per what @kostajh shared in T413354#11739268?

Sorry for the confusion. The solution on desktop would be exactly the same on both desktop and mobile, appearing the hCaptcha on top of the Publish dialog with an additional background-color-backdrop-light overlay between the Dialog and the hCaptcha to visually separate both elements.

image.png (2,866×1,452 px, 1 MB)
Captura de pantalla 2026-02-23 a las 15.15.57.png (1,142×1,138 px, 309 KB)
desktopmobile

Thank you, @bmartinezcalvo!

Next steps
@kostajh to what extent (if any) would it be accurate for me to think the next step here is for y'all (PSI) to implement what Bárbara specified?

Thank you, @bmartinezcalvo!

Next steps
@kostajh to what extent (if any) would it be accurate for me to think the next step here is for y'all (PSI) to implement what Bárbara specified?

We will take a look at it to see if it's doable with the hCaptcha SDK. thanks!

Dreamy_Jazz subscribed.

We've got it working in a doable way for WMF wikis, so we will implement the designs as specified above for WMF wikis. For third-party wikis (that do not use enterprise hCaptcha) we will have to expand the dialog, as it's not possible to render the challenge outside the dialog.