John,

I believe this option was introduced with version 4.4.0.  Login as using an account with Host or Admin privileges...

Admin > User Accounts

Click the "User Settings" link at the bottom

Under the "User Accounts Settings" section scroll down and you will see two options...

• Use CAPTCHA For Login:
• Use CAPTCHA For Registration:

As far as other suggestions, I would definitely use "Validated registrations".  This will send an email to the resistered party with a verification number that they must use when they first login after registering.  If they don't use their "real" email they will not get the validation number so they won't be able to login.  This can be turned on as follows...

Admin > Site Settings

Scroll down to "Advanced Settings" and you will find the "User Registration" checkbox under "Security Settings".

• None: The administrator has to create user accounts.
• Private: Anyone can register but no one can login until the Administrator authorizes the user.
• Public: Anyone can register and they are able to login immediately after registration.
• Verified: Anyone can register and they are sent an email with a verification number.  The first time they attempt to login they must enter the verification code so their account is "authorized".

I hope this helps.

Chuck R.

OK - problem solved - although it all got a bit frantic there for a while.

I had to comment out the line in the web.config that related to compression. This caused the site to restart. I was then able to login (i.e the captcha image displayed) and then disable captcha for login.

A bit more research found that I could turn compression back on and with a different whitespace filter still have captcha work. The filter being (?<=[>])\s{2,}(?=[<])|(?<=[>])\s{2,}(?= )|(?<= )\s{2,}(?=[<])

So, Chuck, I would suggest a word of warning in future to people you suggest simply to turn on captcha regarding this little gotcha.