Sounds like you need the feature toggle as global rather than a 'base discount classes' one.

Why not have JS track the number of submits without a successful and then conditionally enable captcha?

Hi @Celerino,

Handling forms with anti forgery token in a cloudflare/WAF environment should be enough to handle brute force. Cloudflare/WAF already has the system in place to auto block requests if it detects multiple attempt from a single source in a certain timeframe. If you are using Optimizley DXP, handling your form requests and response with form antiforgerytoken and proper response with status code should be enough to handle brute force attacks.

If you are using on-premise enviornment, then you should consider reCaptcha as an option to handle such requests.

~ Sujit

If it still gets past the AnitForgeryToken and cloudflare, have you considered implementing honeypot? It's less intrusive (and an additional step for users) like re-captcha but allows you to target spam traffic.

https://stackoverflow.com/questions/36227376/better-honeypot-implementation-form-anti-spam