Disable Sophos Firewall CAPTCHA: WebAdmin and User Portal
CAPTCHA for the WebAdmin login and User Portal can be disabled in Device Console. Use the VPN-specific setting whenever possible. The global setting applies to WAN and VPN and overrides the VPN-specific configuration.
⚠️ Warning: If the login page remains accessible from the WAN or an untrusted network, CAPTCHA should remain enabled and access should also be restricted with MFA and Device Access.
Change CAPTCHA in Device Console
Open Main Menu > 4. Device Console over SSH. The following commands belong at the console> prompt, not in the Advanced Shell. The article Connect to Sophos Firewall using SSH explains how to connect.
The commands always follow this structure:
system captcha-authentication-SCOPE AKTION for ZIEL
Replace the placeholders as follows:
| Placeholder | Value | Meaning |
|---|---|---|
SCOPE | global | Applies to WAN and VPN and overrides vpn |
SCOPE | vpn | Applies only to access over a VPN interface |
AKTION | show, disable, or enable | Show status, disable, or enable |
ZIEL | webadminconsole or userportal | WebAdmin login or User Portal |
The notation with SCOPE, AKTION, and ZIEL is only a syntax explanation and is not a command that can be copied.
Example: Disable WebAdmin globally
Check the status:
system captcha-authentication-global show for webadminconsole
Disable CAPTCHA:
system captcha-authentication-global disable for webadminconsole
For User Portal, replace webadminconsole with userportal. To apply the change only to VPN access, replace global with vpn. Run only the command for the required scope and the affected login page.
Then test the affected login from the intended network and check the status again using the same syntax with the show action.
Re-enable CAPTCHA
Replace disable with enable. For the previous example, the rollback is:
system captcha-authentication-global enable for webadminconsole
Check before disabling CAPTCHA
- WebAdmin or User Portal is accessible only from the zones and sources that are actually required.
- MFA is enabled for administrators and affected remote access users.
- The current status and intended rollback are documented.
- For a site-to-site IPsec tunnel with Remote Subnet
Any, check whether a targeted IPsec route is the better solution.
The commands control only WebAdmin and User Portal. They do not disable CAPTCHA on VPN Portal or SPX Portal and do not change SSL VPN or IPsec tunnels. CAPTCHA therefore remains permanently active in the SPX email encryption workflow.
SFOS 22.0 GA: Because of issue
NC-173054, VPN-specific disabling does not work reliably for SSL VPN users. Upgrade to SFOS 22.0 MR1 Build 490 or later. Disabling CAPTCHA globally is not a suitable workaround.
Frequently asked questions
Can CAPTCHA be changed separately for WebAdmin and User Portal?
webadminconsole or userportal as the target.Does the setting also apply to VPN Portal or SSL VPN?
captcha-authentication-vpn only means that the WebAdmin or User Portal setting applies when access takes place over a VPN interface. VPN Portal and VPN tunnels are configured separately.