A captcha can be enabled on your homeserver to help prevent bots from registering accounts. Synapse currently uses Google's reCAPTCHA service which requires API keys from Google.
homeserver.yaml, to the list of authorized domains. If you have not set
Copy your site key and secret key and add them to your
recaptcha_public_key: YOUR_SITE_KEY recaptcha_private_key: YOUR_SECRET_KEY
Enable the CAPTCHA for new registrations
Go to the settings page for the CAPTCHA you just created
Uncheck the "Verify the origin of reCAPTCHA solutions" checkbox so that the captcha can be displayed in any client. If you do not disable this option then you must specify the domains of every client that is allowed to display the CAPTCHA.
The reCAPTCHA API requires that the IP address of the user who solved the
CAPTCHA is sent. If the client is connecting through a proxy or load balancer,
it may be required to use the
X-Forwarded-For (XFF) header instead of the origin
IP address. This can be configured using the
x_forwarded directive in the
listeners section of the
homeserver.yaml configuration file.