WikimediaEvents: Log hCaptcha risk scores for account creation events
Closed, ResolvedPublic
Actions

Description

Summary

The mediawiki/hcaptcha/risk_score schema supports action=createaccount and identifier_type=account, but no such events are currently produced to that schema, because we currently log only to serversideaccountcreation.

Technical notes

WikimediaEvents/includes/EditPage/CaptchaScoreHooks.php implements PageSaveComplete and EditPage::attemptSave_after. We should add a handler for account creation.

We can leave the existing serversideaccountcreation schema integration in place for now.

Acceptance criteria

account creations that are checked by hCaptcha emit a createaccount event with identifier_type=account and a valid risk score in the hcaptcha/risk_score schema

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	CaptchaScoreHooks: Collect risk score for account creations	mediawiki/extensions/WikimediaEvents	master	+179 -19

Customize query in gerrit

Event Timeline

kostajh created this task.Apr 9 2026, 8:34 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 9 2026, 8:34 PM

OKryva-WMF edited projects, added Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)); removed Product Safety and Integrity (Sprint Forsythia (Mar 23 - Apr 10))).Apr 14 2026, 7:52 AM

OKryva-WMF moved this task from Backlog to Ready on the Bot detection and mitigation (WE4.2 hCaptcha editing trial) board.Apr 14 2026, 8:39 AM

Dreamy_Jazz claimed this task.Apr 16 2026, 10:26 AM

Dreamy_Jazz moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)) board.

Change #1272647 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/WikimediaEvents@master] CaptchaScoreHooks: Collect risk score for account creations

https://gerrit.wikimedia.org/r/1272647

gerritbot added a project: Patch-For-Review.Apr 16 2026, 11:11 AM

Dreamy_Jazz moved this task from Ready to In progress on the Bot detection and mitigation (WE4.2 hCaptcha editing trial) board.Apr 16 2026, 11:16 AM

Dreamy_Jazz moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)) board.

hector.arroyo updated the task description. (Show Details)Apr 20 2026, 3:40 PM

Change #1272647 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@master] CaptchaScoreHooks: Collect risk score for account creations

https://gerrit.wikimedia.org/r/1272647

Maintenance_bot removed a project: Patch-For-Review.Apr 23 2026, 10:31 AM

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.26; 2026-04-28).Apr 23 2026, 11:00 AM

kostajh moved this task from Needs review to QA in Prod on the Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)) board.Apr 23 2026, 11:51 AM

Testing notes

I don't really know about this, so a developer could pick this up.

Yeah, it should be possible to verify this by looking at the data. I can look soon or latest next week when I'm back

In T422881#11874488, @dom_walden wrote:

Testing notes

I don't really know about this, so a developer could pick this up.

Confirmed that this is working:

spark-sql (default)> SELECT action, performer.user_text, identifier, identifier_type FROM event.mediawiki_hcaptcha_risk_score WHERE year = 2026 and month = 4 and day = 30 and action != 'edit' and action == 'createaccount';
action  user_text       identifier      identifier_type
createaccount   IOS-Eng-Test-20260429   73759   account

WikimediaEvents: Log hCaptcha risk scores for account creation eventsClosed, ResolvedPublicActions

Description

Summary

Technical notes

Acceptance criteria

Details

Event Timeline

Testing notes

Testing notes

WikimediaEvents: Log hCaptcha risk scores for account creation events
Closed, ResolvedPublic
Actions