diff --git a/build.gradle b/build.gradle
index 16f124f..d6c7d09 100644
--- a/build.gradle
+++ b/build.gradle
@@ -16,7 +16,7 @@ repositories {
 }
 
 dependencies {
-    implementation platform('run.halo.tools.platform:plugin:2.9.0-SNAPSHOT')
+    implementation platform('run.halo.tools.platform:plugin:2.13.0-SNAPSHOT')
     compileOnly 'run.halo.app:api'
 
     testImplementation 'run.halo.app:api'
@@ -42,4 +42,5 @@ build {
 
 halo {
     version = "2.15.0-rc.1"
+    debug = true
 }
diff --git a/packages/comment-widget/src/base-form.ts b/packages/comment-widget/src/base-form.ts
index 216ff34..c8991aa 100644
--- a/packages/comment-widget/src/base-form.ts
+++ b/packages/comment-widget/src/base-form.ts
@@ -1,20 +1,23 @@
-import './emoji-button';
+import type { User } from '@halo-dev/api-client';
+import { consume } from '@lit/context';
 import { css, html, LitElement } from 'lit';
+import { property, state } from 'lit/decorators.js';
 import { createRef, Ref, ref } from 'lit/directives/ref.js';
 import {
   allowAnonymousCommentsContext,
   baseUrlContext,
+  captchaEnabledContext,
   currentUserContext,
   groupContext,
   kindContext,
   nameContext,
+  toastContext,
 } from './context';
-import { property, state } from 'lit/decorators.js';
-import type { User } from '@halo-dev/api-client';
+import './emoji-button';
+import './icons/icon-loading';
+import { ToastManager } from './lit-toast';
 import baseStyles from './styles/base';
-import { consume } from '@lit/context';
 import varStyles from './styles/var';
-import './icons/icon-loading';
 
 export class BaseForm extends LitElement {
   @consume({ context: baseUrlContext })
@@ -29,6 +32,10 @@ export class BaseForm extends LitElement {
   @state()
   allowAnonymousComments = false;
 
+  @consume({ context: captchaEnabledContext, subscribe: true })
+  @state()
+  captchaEnabled = false;
+
   @consume({ context: groupContext })
   @state()
   group = '';
@@ -41,9 +48,17 @@ export class BaseForm extends LitElement {
   @state()
   name = '';
 
+  @property({ type: String })
+  @state()
+  captcha = '';
+
   @property({ type: Boolean })
   submitting = false;
 
+  @consume({ context: toastContext, subscribe: true })
+  @state()
+  toastManager: ToastManager | undefined;
+
   textareaRef: Ref<HTMLTextAreaElement> = createRef<HTMLTextAreaElement>();
 
   get customAccount() {
@@ -58,6 +73,25 @@ export class BaseForm extends LitElement {
     return `/console/login?redirect_uri=${encodeURIComponent(window.location.href + parentDomId)}`;
   }
 
+  get showCaptcha() {
+    return this.captchaEnabled && !this.currentUser;
+  }
+
+  async handleFetchCaptcha() {
+    if (!this.showCaptcha) {
+      return;
+    }
+
+    const response = await fetch(`/apis/api.commentwidget.halo.run/v1alpha1/captcha/-/generate`);
+
+    if (!response.ok) {
+      this.toastManager?.error('获取验证码失败');
+      return;
+    }
+
+    this.captcha = await response.text();
+  }
+
   handleOpenLoginPage() {
     window.location.href = this.loginUrl;
   }
@@ -124,6 +158,7 @@ export class BaseForm extends LitElement {
   override connectedCallback(): void {
     super.connectedCallback();
     this.addEventListener('keydown', this.onKeydown);
+    this.handleFetchCaptcha();
   }
 
   override disconnectedCallback(): void {
@@ -182,6 +217,20 @@ export class BaseForm extends LitElement {
               </button> `
             : ''}
           <div class="form__actions">
+            ${this.showCaptcha
+              ? html`
+                  <div class="form__action--captcha">
+                    <input name="captchaCode" type="text" placeholder="请输入验证码" />
+                    <img
+                      @click=${this.handleFetchCaptcha}
+                      src="${this.captcha}"
+                      alt="captcha"
+                      width="100%"
+                    />
+                  </div>
+                `
+              : ''}
+
             <emoji-button @emoji-select=${this.onEmojiSelect}></emoji-button>
             <button .disabled=${this.submitting} type="submit" class="form__button--submit">
               ${this.submitting
@@ -286,7 +335,7 @@ export class BaseForm extends LitElement {
         border: 0.05em solid var(--component-form-input-border-color);
         font-size: 0.875em;
         display: block;
-        height: 2.25em;
+        height: 2.65em;
         max-width: 100%;
         outline: 0;
         padding: 0.4em 0.75em;
@@ -349,12 +398,26 @@ export class BaseForm extends LitElement {
 
       .form__actions {
         display: flex;
+        flex-wrap: wrap;
         align-items: center;
         gap: 0.75em;
-        flex: 1 1 auto;
+        width: 100%;
         justify-content: flex-end;
       }
 
+      .form__action--captcha {
+        display: flex;
+        align-items: center;
+        gap: 0.3em;
+        flex-direction: row-reverse;
+      }
+
+      .form__action--captcha img {
+        height: 2.25em;
+        width: auto;
+        border-radius: var(--base-border-radius);
+      }
+
       .form__button--submit {
         border-radius: var(--base-border-radius);
         background-color: var(--component-form-button-submit-bg-color);
diff --git a/packages/comment-widget/src/comment-form.ts b/packages/comment-widget/src/comment-form.ts
index ebabd7c..197b1fd 100644
--- a/packages/comment-widget/src/comment-form.ts
+++ b/packages/comment-widget/src/comment-form.ts
@@ -1,6 +1,10 @@
-import { html, LitElement } from 'lit';
-import { state } from 'lit/decorators.js';
+import { Comment, CommentRequest, User } from '@halo-dev/api-client';
 import { consume } from '@lit/context';
+import { LitElement, html } from 'lit';
+import { state } from 'lit/decorators.js';
+import { Ref, createRef, ref } from 'lit/directives/ref.js';
+import './base-form';
+import { BaseForm } from './base-form';
 import {
   allowAnonymousCommentsContext,
   baseUrlContext,
@@ -11,11 +15,8 @@ import {
   toastContext,
   versionContext,
 } from './context';
-import { Comment, CommentRequest, User } from '@halo-dev/api-client';
-import { createRef, Ref, ref } from 'lit/directives/ref.js';
-import { BaseForm } from './base-form';
-import './base-form';
 import { ToastManager } from './lit-toast';
+import { getCaptchaCodeHeader, isRequireCaptcha } from './utils/captcha';
 
 export class CommentForm extends LitElement {
   @consume({ context: baseUrlContext })
@@ -53,11 +54,15 @@ export class CommentForm extends LitElement {
   @state()
   submitting = false;
 
+  @state()
+  captcha = '';
+
   baseFormRef: Ref<BaseForm> = createRef<BaseForm>();
 
   override render() {
     return html` <base-form
       .submitting=${this.submitting}
+      .captcha=${this.captcha}
       ${ref(this.baseFormRef)}
       @submit="${this.onSubmit}"
     ></base-form>`;
@@ -110,10 +115,20 @@ export class CommentForm extends LitElement {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
+          ...getCaptchaCodeHeader(data.captchaCode),
         },
         body: JSON.stringify(commentRequest),
       });
 
+      if (isRequireCaptcha(response)) {
+        const { captcha, detail } = await response.json();
+        this.captcha = captcha;
+        this.toastManager?.warn(detail);
+        return;
+      }
+
+      this.baseFormRef.value?.handleFetchCaptcha();
+
       if (!response.ok) {
         throw new Error('评论失败，请稍后重试');
       }
diff --git a/packages/comment-widget/src/comment-widget.ts b/packages/comment-widget/src/comment-widget.ts
index f349d94..2f92f13 100644
--- a/packages/comment-widget/src/comment-widget.ts
+++ b/packages/comment-widget/src/comment-widget.ts
@@ -1,11 +1,26 @@
-import { css, html, LitElement } from 'lit';
-import { property, state } from 'lit/decorators.js';
 import { CommentVoList, User } from '@halo-dev/api-client';
-import { repeat } from 'lit/directives/repeat.js';
-import baseStyles from './styles/base';
 import { provide } from '@lit/context';
+import { LitElement, css, html } from 'lit';
+import { property, state } from 'lit/decorators.js';
+import { repeat } from 'lit/directives/repeat.js';
 import {
+  AllUserPolicy,
+  AnonymousUserPolicy,
+  AvatarPolicyEnum,
+  NoAvatarUserPolicy,
+  setPolicyInstance,
+} from './avatar/avatar-policy';
+import { setAvatarProvider } from './avatar/providers';
+import './comment-form';
+import './comment-item';
+import './comment-pagination';
+import {
+  allowAnonymousCommentsContext,
+  avatarPolicyContext,
+  avatarProviderContext,
+  avatarProviderMirrorContext,
   baseUrlContext,
+  captchaEnabledContext,
   currentUserContext,
   emojiDataUrlContext,
   groupContext,
@@ -13,27 +28,13 @@ import {
   nameContext,
   replySizeContext,
   toastContext,
+  useAvatarProviderContext,
   versionContext,
   withRepliesContext,
-  allowAnonymousCommentsContext,
-  useAvatarProviderContext,
-  avatarPolicyContext,
-  avatarProviderContext,
-  avatarProviderMirrorContext,
 } from './context';
-import './comment-form';
-import './comment-item';
-import './comment-pagination';
-import varStyles from './styles/var';
 import { ToastManager } from './lit-toast';
-import {
-  AnonymousUserPolicy,
-  AllUserPolicy,
-  NoAvatarUserPolicy,
-  AvatarPolicyEnum,
-  setPolicyInstance,
-} from './avatar/avatar-policy';
-import { setAvatarProvider } from './avatar/providers';
+import baseStyles from './styles/base';
+import varStyles from './styles/var';
 
 export class CommentWidget extends LitElement {
   @provide({ context: baseUrlContext })
@@ -98,6 +99,10 @@ export class CommentWidget extends LitElement {
   @state()
   allowAnonymousComments = false;
 
+  @provide({ context: captchaEnabledContext })
+  @property({ type: Boolean, attribute: 'enable-captcha' })
+  captchaEnabled = false;
+
   @provide({ context: toastContext })
   @state()
   toastManager: ToastManager | undefined;
diff --git a/packages/comment-widget/src/context/index.ts b/packages/comment-widget/src/context/index.ts
index 5d7d01b..d35c564 100644
--- a/packages/comment-widget/src/context/index.ts
+++ b/packages/comment-widget/src/context/index.ts
@@ -18,6 +18,8 @@ export const allowAnonymousCommentsContext = createContext<boolean>(
   Symbol('allowAnonymousComments')
 );
 
+export const captchaEnabledContext = createContext<boolean>(Symbol('captchaEnabledContext'));
+
 export const currentUserContext = createContext<User | undefined>(Symbol('currentUser'));
 
 export const emojiDataUrlContext = createContext<string>(Symbol('emojiDataUrl'));
diff --git a/packages/comment-widget/src/reply-form.ts b/packages/comment-widget/src/reply-form.ts
index 6d024fd..5c5f79a 100644
--- a/packages/comment-widget/src/reply-form.ts
+++ b/packages/comment-widget/src/reply-form.ts
@@ -1,17 +1,18 @@
-import './base-form';
 import { CommentVo, Reply, ReplyRequest, ReplyVo, User } from '@halo-dev/api-client';
-import { html, LitElement } from 'lit';
-import { createRef, Ref, ref } from 'lit/directives/ref.js';
+import { consume } from '@lit/context';
+import { LitElement, html } from 'lit';
+import { property, state } from 'lit/decorators.js';
+import { Ref, createRef, ref } from 'lit/directives/ref.js';
+import './base-form';
+import { BaseForm } from './base-form';
 import {
   allowAnonymousCommentsContext,
   baseUrlContext,
   currentUserContext,
   toastContext,
 } from './context';
-import { property, state } from 'lit/decorators.js';
-import { BaseForm } from './base-form';
-import { consume } from '@lit/context';
 import { ToastManager } from './lit-toast';
+import { getCaptchaCodeHeader, isRequireCaptcha } from './utils/captcha';
 
 export class ReplyForm extends LitElement {
   @consume({ context: baseUrlContext })
@@ -39,6 +40,9 @@ export class ReplyForm extends LitElement {
   @state()
   submitting = false;
 
+  @state()
+  captcha = '';
+
   baseFormRef: Ref<BaseForm> = createRef<BaseForm>();
 
   override connectedCallback(): void {
@@ -53,6 +57,7 @@ export class ReplyForm extends LitElement {
   override render() {
     return html` <base-form
       .submitting=${this.submitting}
+      .captcha=${this.captcha}
       ${ref(this.baseFormRef)}
       @submit="${this.onSubmit}"
     ></base-form>`;
@@ -105,11 +110,21 @@ export class ReplyForm extends LitElement {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
+            ...getCaptchaCodeHeader(data.captchaCode),
           },
           body: JSON.stringify(replyRequest),
         }
       );
 
+      if (isRequireCaptcha(response)) {
+        const { captcha, detail } = await response.json();
+        this.captcha = captcha;
+        this.toastManager?.warn(detail);
+        return;
+      }
+
+      this.baseFormRef.value?.handleFetchCaptcha();
+
       if (!response.ok) {
         throw new Error('评论失败，请稍后重试');
       }
diff --git a/packages/comment-widget/src/utils/captcha.ts b/packages/comment-widget/src/utils/captcha.ts
new file mode 100644
index 0000000..21299f5
--- /dev/null
+++ b/packages/comment-widget/src/utils/captcha.ts
@@ -0,0 +1,12 @@
+export const getCaptchaCodeHeader = (code: string): Record<string, string> => {
+  if (!code || code.trim().length === 0) {
+    return {};
+  }
+  return {
+    'X-Captcha-Code': code,
+  };
+};
+
+export const isRequireCaptcha = (response: Response) => {
+  return response.status === 403 && response.headers.get('X-Require-Captcha');
+};
diff --git a/packages/widget/src/index.ts b/packages/widget/src/index.ts
index 1e32d95..4aa74f8 100644
--- a/packages/widget/src/index.ts
+++ b/packages/widget/src/index.ts
@@ -15,6 +15,7 @@ interface Props {
   avatarProvider?: string;
   avatarProviderMirror?: string;
   avatarPolicy?: string;
+  captchaEnabled: boolean;
 }
 
 export function init(el: string, props: Props) {
@@ -42,6 +43,7 @@ export function init(el: string, props: Props) {
   commentWidget.avatarProvider = props.avatarProvider || '';
   commentWidget.avatarProviderMirror = props.avatarProviderMirror || '';
   commentWidget.avatarPolicy = props.avatarPolicy || '';
+  commentWidget.captchaEnabled = props.captchaEnabled || false;
 
   const observer = new IntersectionObserver((entries) => {
     entries.forEach((entry) => {
diff --git a/src/main/java/run/halo/comment/widget/DefaultCommentWidget.java b/src/main/java/run/halo/comment/widget/DefaultCommentWidget.java
index 9dd7948..baeb9f5 100644
--- a/src/main/java/run/halo/comment/widget/DefaultCommentWidget.java
+++ b/src/main/java/run/halo/comment/widget/DefaultCommentWidget.java
@@ -30,6 +30,7 @@ public class DefaultCommentWidget implements CommentWidget {
 
     private final PluginWrapper pluginWrapper;
     private final SettingFetcher settingFetcher;
+    private final SettingConfigGetter settingConfigGetter;
 
     @Override
     public void render(ITemplateContext context,
@@ -40,7 +41,7 @@ public void render(ITemplateContext context,
         IAttribute nameAttribute = tag.getAttribute("name");
 
         structureHandler.replaceWith(commentHtml(groupAttribute, kindAttribute, nameAttribute),
-                false);
+            false);
     }
 
     private String commentHtml(IAttribute groupAttribute, IAttribute kindAttribute,
@@ -65,41 +66,49 @@ private String commentHtml(IAttribute groupAttribute, IAttribute kindAttribute,
         properties.setProperty("domId", domIdFrom(group, kindAttribute.getValue(), nameAttribute.getValue()));
 
         var basicConfig = settingFetcher.fetch(BasicConfig.GROUP, BasicConfig.class)
-                .orElse(new BasicConfig());
+            .orElse(new BasicConfig());
         properties.setProperty("size", String.valueOf(basicConfig.getSize()));
         properties.setProperty("replySize", String.valueOf(basicConfig.getReplySize()));
         properties.setProperty("withReplies", String.valueOf(basicConfig.isWithReplies()));
         properties.setProperty("withReplySize", String.valueOf(basicConfig.getWithReplySize()));
 
         var avatarConfig = settingFetcher.fetch(AvatarConfig.GROUP, AvatarConfig.class)
-                .orElse(new AvatarConfig());
+            .orElse(new AvatarConfig());
         properties.setProperty("useAvatarProvider", String.valueOf(avatarConfig.isEnable()));
         properties.setProperty("avatarProvider", String.valueOf(avatarConfig.getProvider()));
         properties.setProperty("avatarProviderMirror", String.valueOf(avatarConfig.getProviderMirror()));
         properties.setProperty("avatarPolicy", String.valueOf(avatarConfig.getPolicy()));
 
+        var captcha = settingConfigGetter.getSecurityConfig()
+            .map(SettingConfigGetter.SecurityConfig::getCaptcha)
+            .map(SettingConfigGetter.CaptchaConfig::isAnonymousCommentCaptcha)
+            .blockOptional()
+            .orElse(false);
+        properties.setProperty("captchaEnabled", String.valueOf(captcha));
+
         // placeholderHelper only support string, so we need to convert boolean to string
         return PROPERTY_PLACEHOLDER_HELPER.replacePlaceholders("""
-                <div id="${domId}"></div>
-                <script>
-                  CommentWidget.init(
-                    "#${domId}",
-                    {
-                      group: "${group}",
-                      kind: "${kind}",
-                      name: "${name}",
-                      size: ${size},
-                      replySize: ${replySize},
-                      withReplies: ${withReplies},
-                      withReplySize: ${withReplySize},
-                      useAvatarProvider: ${useAvatarProvider},
-                      avatarProvider: "${avatarProvider}",
-                      avatarProviderMirror: "${avatarProviderMirror}",
-                      avatarPolicy: "${avatarPolicy}",
-                    }
-                  );
-                </script>
-                """, properties);
+            <div id="${domId}"></div>
+            <script>
+              CommentWidget.init(
+                "#${domId}",
+                {
+                  group: "${group}",
+                  kind: "${kind}",
+                  name: "${name}",
+                  size: ${size},
+                  replySize: ${replySize},
+                  withReplies: ${withReplies},
+                  withReplySize: ${withReplySize},
+                  useAvatarProvider: ${useAvatarProvider},
+                  avatarProvider: "${avatarProvider}",
+                  avatarProviderMirror: "${avatarProviderMirror}",
+                  avatarPolicy: "${avatarPolicy}",
+                  captchaEnabled: ${captchaEnabled},
+                }
+              );
+            </script>
+            """, properties);
     }
 
     @Data
@@ -125,11 +134,11 @@ private String domIdFrom(String group, String kind, String name) {
         Assert.notNull(kind, "The kind must not be null.");
         String groupKindNameAsDomId = String.join("-", group, kind, name);
         return "comment-" + groupKindNameAsDomId.replaceAll("[^\\-_a-zA-Z0-9\\s]", "-")
-                .replaceAll("(-)+", "-");
+            .replaceAll("(-)+", "-");
     }
 
     private String getGroup(IAttribute groupAttribute) {
         return groupAttribute.getValue() == null ? ""
-                : StringUtils.defaultString(groupAttribute.getValue());
+            : StringUtils.defaultString(groupAttribute.getValue());
     }
 }
diff --git a/src/main/java/run/halo/comment/widget/SettingConfigGetter.java b/src/main/java/run/halo/comment/widget/SettingConfigGetter.java
new file mode 100644
index 0000000..1b20d3f
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/SettingConfigGetter.java
@@ -0,0 +1,49 @@
+package run.halo.comment.widget;
+
+import lombok.Data;
+import lombok.Getter;
+import lombok.experimental.Accessors;
+import org.springframework.lang.NonNull;
+import reactor.core.publisher.Mono;
+import run.halo.comment.widget.captcha.CaptchaType;
+
+public interface SettingConfigGetter {
+
+    Mono<SecurityConfig> getSecurityConfig();
+
+    @Data
+    @Accessors(chain = true)
+    class SecurityConfig {
+        @Getter(onMethod_ = @NonNull)
+        private CaptchaConfig captcha;
+
+        public SecurityConfig setCaptcha(CaptchaConfig captcha) {
+            this.captcha = (captcha == null ? CaptchaConfig.empty() : captcha);
+            return this;
+        }
+
+        public static SecurityConfig empty() {
+            return new SecurityConfig()
+                .setCaptcha(CaptchaConfig.empty());
+        }
+    }
+
+    @Data
+    @Accessors(chain = true)
+    class CaptchaConfig {
+
+        private boolean anonymousCommentCaptcha;
+
+        @Getter(onMethod_ = @NonNull)
+        private CaptchaType type = CaptchaType.ALPHANUMERIC;
+
+        public CaptchaConfig setType(CaptchaType type) {
+            this.type = (type == null ? CaptchaType.ALPHANUMERIC : type);
+            return this;
+        }
+
+        public static CaptchaConfig empty() {
+            return new CaptchaConfig();
+        }
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/SettingConfigGetterImpl.java b/src/main/java/run/halo/comment/widget/SettingConfigGetterImpl.java
new file mode 100644
index 0000000..07e8113
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/SettingConfigGetterImpl.java
@@ -0,0 +1,76 @@
+package run.halo.comment.widget;
+
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+
+import java.util.function.Function;
+import com.google.common.cache.Cache;
+import com.google.common.cache.CacheBuilder;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Mono;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.DefaultExtensionMatcher;
+import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.controller.Controller;
+import run.halo.app.extension.controller.ControllerBuilder;
+import run.halo.app.extension.controller.Reconciler;
+import run.halo.app.extension.router.selector.FieldSelector;
+import run.halo.app.plugin.ReactiveSettingFetcher;
+
+@Component
+@RequiredArgsConstructor
+public class SettingConfigGetterImpl implements SettingConfigGetter {
+    private final ReactiveSettingFetcher settingFetcher;
+    private final SettingConfigCache settingConfigCache;
+
+    @Override
+    public Mono<SecurityConfig> getSecurityConfig() {
+        return settingConfigCache.get("security",
+            key -> settingFetcher.fetch("security", SecurityConfig.class)
+                .defaultIfEmpty(SecurityConfig.empty())
+        );
+    }
+
+    interface SettingConfigCache {
+        <T> Mono<T> get(String key, Function<String, Mono<T>> loader);
+    }
+
+    @Component
+    @RequiredArgsConstructor
+    static class SettingConfigCacheImpl implements Reconciler<Reconciler.Request>, SettingConfigCache {
+        private static final String CONFIG_NAME = "plugin-comment-widget-configmap";
+
+        private final Cache<String, Object> cache = CacheBuilder.newBuilder()
+            .maximumSize(10)
+            .build();
+
+        private final ExtensionClient client;
+
+        @SuppressWarnings("unchecked")
+        public <T> Mono<T> get(String key, Function<String, Mono<T>> loader) {
+            return Mono.justOrEmpty(cache.getIfPresent(key))
+                .switchIfEmpty(loader.apply(key).doOnNext(value -> cache.put(key, value)))
+                .map(object -> (T) object);
+        }
+
+        @Override
+        public Result reconcile(Request request) {
+            cache.invalidateAll();
+            return Result.doNotRetry();
+        }
+
+        @Override
+        public Controller setupWith(ControllerBuilder builder) {
+            var extension = new ConfigMap();
+            var extensionMatcher = DefaultExtensionMatcher.builder(client, extension.groupVersionKind())
+                .fieldSelector(FieldSelector.of(equal("metadata.name", CONFIG_NAME)))
+                .build();
+            return builder
+                .extension(extension)
+                .syncAllOnStart(false)
+                .onAddMatcher(extensionMatcher)
+                .onUpdateMatcher(extensionMatcher)
+                .build();
+        }
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaCookieResolver.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaCookieResolver.java
new file mode 100644
index 0000000..87c739f
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaCookieResolver.java
@@ -0,0 +1,19 @@
+package run.halo.comment.widget.captcha;
+
+import java.time.Duration;
+import org.springframework.http.HttpCookie;
+import org.springframework.lang.Nullable;
+import org.springframework.web.server.ServerWebExchange;
+
+public interface CaptchaCookieResolver {
+    @Nullable
+    HttpCookie resolveCookie(ServerWebExchange exchange);
+
+    void setCookie(ServerWebExchange exchange, String value);
+
+    void expireCookie(ServerWebExchange exchange);
+
+    String getCookieName();
+
+    Duration getCookieMaxAge();
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaCookieResolverImpl.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaCookieResolverImpl.java
new file mode 100644
index 0000000..f62cc35
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaCookieResolverImpl.java
@@ -0,0 +1,49 @@
+package run.halo.comment.widget.captcha;
+
+import java.time.Duration;
+import lombok.Getter;
+import org.springframework.http.HttpCookie;
+import org.springframework.http.ResponseCookie;
+import org.springframework.lang.Nullable;
+import org.springframework.stereotype.Component;
+import org.springframework.util.Assert;
+import org.springframework.web.server.ServerWebExchange;
+
+@Getter
+@Component
+public class CaptchaCookieResolverImpl implements CaptchaCookieResolver {
+    public static final String CAPTCHA_COOKIE_KEY = "comment-widget-captcha";
+
+    private final String cookieName = CAPTCHA_COOKIE_KEY;
+
+    private final Duration cookieMaxAge = Duration.ofHours(1);
+
+    @Override
+    @Nullable
+    public HttpCookie resolveCookie(ServerWebExchange exchange) {
+        return exchange.getRequest().getCookies().getFirst(getCookieName());
+    }
+
+    @Override
+    public void setCookie(ServerWebExchange exchange, String value) {
+        Assert.notNull(value, "'value' is required");
+        exchange.getResponse().getCookies()
+            .set(getCookieName(), initCookie(exchange, value).build());
+    }
+
+    @Override
+    public void expireCookie(ServerWebExchange exchange) {
+        ResponseCookie cookie = initCookie(exchange, "").maxAge(0).build();
+        exchange.getResponse().getCookies().set(this.cookieName, cookie);
+    }
+
+    private ResponseCookie.ResponseCookieBuilder initCookie(ServerWebExchange exchange,
+                                                            String value) {
+        return ResponseCookie.from(this.cookieName, value)
+            .path(exchange.getRequest().getPath().contextPath().value() + "/")
+            .maxAge(getCookieMaxAge())
+            .httpOnly(true)
+            .secure("https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme()))
+            .sameSite("Lax");
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaEndpoint.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaEndpoint.java
new file mode 100644
index 0000000..18edb95
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaEndpoint.java
@@ -0,0 +1,39 @@
+package run.halo.comment.widget.captcha;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
+import run.halo.app.extension.GroupVersion;
+import run.halo.comment.widget.SettingConfigGetter;
+
+@Component
+@RequiredArgsConstructor
+public class CaptchaEndpoint implements CustomEndpoint {
+
+    private final CaptchaManager captchaManager;
+    private final SettingConfigGetter settingConfigGetter;
+
+    @Override
+    public RouterFunction<ServerResponse> endpoint() {
+        return RouterFunctions.route()
+            .GET("captcha/-/generate", this::generateCaptcha)
+            .build();
+    }
+
+    private Mono<ServerResponse> generateCaptcha(ServerRequest request) {
+        return settingConfigGetter.getSecurityConfig()
+            .map(SettingConfigGetter.SecurityConfig::getCaptcha)
+            .flatMap(captchaConfig -> captchaManager.generate(request.exchange(), captchaConfig.getType()))
+            .flatMap(captcha -> ServerResponse.ok().bodyValue(captcha.imageBase64()));
+    }
+
+    @Override
+    public GroupVersion groupVersion() {
+        return GroupVersion.parseAPIVersion("api.commentwidget.halo.run/v1alpha1");
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaGenerator.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaGenerator.java
new file mode 100644
index 0000000..ea5d651
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaGenerator.java
@@ -0,0 +1,142 @@
+package run.halo.comment.widget.captcha;
+
+import javax.imageio.ImageIO;
+import java.awt.*;
+import java.awt.image.BufferedImage;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Base64;
+import java.util.Random;
+import java.util.function.Function;
+import lombok.experimental.UtilityClass;
+import lombok.extern.slf4j.Slf4j;
+
+@Slf4j
+@UtilityClass
+public class CaptchaGenerator {
+    private static final String CHAR_STRING = "ABCDEFGHJKMNPRSTUVWXYZabcdefghjkmnpqrstuvwxyz0123456789";
+    private static final int WIDTH = 120;
+    private static final int HEIGHT = 36;
+    private static final int CHAR_LENGTH = 4;
+
+    private static final Font customFont;
+
+    static {
+        customFont = loadArialFont();
+    }
+
+    public static Captcha generateMathCaptcha() {
+        return generateCaptchaImage(CaptchaGenerator::drawMathCaptchaText);
+    }
+
+    public static Captcha generateSimpleCaptcha() {
+        return generateCaptchaImage(CaptchaGenerator::drawSimpleText);
+    }
+
+    private static Captcha generateCaptchaImage(Function<Graphics2D, String> drawCaptchaTextFunc) {
+        BufferedImage bufferedImage = new BufferedImage(WIDTH, HEIGHT, BufferedImage.TYPE_INT_RGB);
+        Graphics2D g2d = bufferedImage.createGraphics();
+
+        // paint white background
+        g2d.setColor(Color.WHITE);
+        g2d.fillRect(0, 0, WIDTH, HEIGHT);
+
+        g2d.setFont(customFont);
+
+        var captchaText = drawCaptchaTextFunc.apply(g2d);
+
+        // add some noise
+        Random random = new Random();
+        for (int i = 0; i < 10; i++) {
+            g2d.setColor(new Color(random.nextInt(256), random.nextInt(256), random.nextInt(256)));
+            int x1 = random.nextInt(WIDTH);
+            int y1 = random.nextInt(HEIGHT);
+            int x2 = random.nextInt(WIDTH);
+            int y2 = random.nextInt(HEIGHT);
+            g2d.drawLine(x1, y1, x2, y2);
+        }
+
+        g2d.dispose();
+        return new Captcha(captchaText, bufferedImage);
+    }
+
+    private static String drawMathCaptchaText(Graphics2D g2d) {
+        Random random = new Random();
+        int num1 = random.nextInt(90) + 1;
+        int num2 = random.nextInt(90) + 1;
+        char operator = getRandomOperator();
+
+        int result;
+        String mathText = switch (operator) {
+            case '+' -> {
+                result = num1 + num2;
+                yield num1 + " + " + num2 + " = ?";
+            }
+            case '-' -> {
+                result = num1 - num2;
+                yield num1 + " - " + num2 + " = ?";
+            }
+            case '*' -> {
+                result = num1 * num2;
+                yield num1 + " * " + num2 + " = ?";
+            }
+            default -> throw new IllegalStateException("Unexpected value: " + operator);
+        };
+
+        g2d.setColor(Color.BLACK);
+        g2d.drawString(mathText, 20, 30);
+        return String.valueOf(result);
+    }
+
+    public record Captcha(String code, BufferedImage image) {
+    }
+
+    private static String drawSimpleText(Graphics2D g2d) {
+        var captchaText = generateRandomText();
+        Random random = new Random();
+        for (int i = 0; i < captchaText.length(); i++) {
+            g2d.setColor(new Color(random.nextInt(256), random.nextInt(256), random.nextInt(256)));
+            g2d.drawString(String.valueOf(captchaText.charAt(i)), 20 + i * 24, 30);
+        }
+        return captchaText;
+    }
+
+    private static Font loadArialFont() {
+        var fontPath = "/fonts/Arial_Bold.ttf";
+        try (InputStream is = CaptchaGenerator.class.getResourceAsStream(fontPath)) {
+            if (is == null) {
+                throw new RuntimeException("Cannot load font file for " + fontPath + ", please check if it exists.");
+            }
+            return Font.createFont(Font.TRUETYPE_FONT, is).deriveFont(Font.BOLD, 24);
+        } catch (FontFormatException | IOException e) {
+            log.warn("Failed to load font file for {}, fallback to default font.", fontPath);
+            return new Font("Serif", Font.BOLD, 24);
+        }
+    }
+
+    private static char getRandomOperator() {
+        char[] operators = {'+', '-', '*'};
+        Random random = new Random();
+        return operators[random.nextInt(operators.length)];
+    }
+
+    private static String generateRandomText() {
+        StringBuilder sb = new StringBuilder(CHAR_LENGTH);
+        Random random = new Random();
+        for (int i = 0; i < CHAR_LENGTH; i++) {
+            sb.append(CHAR_STRING.charAt(random.nextInt(CHAR_STRING.length())));
+        }
+        return sb.toString();
+    }
+
+    public static String encodeToBase64(BufferedImage image) {
+        try (ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) {
+            ImageIO.write(image, "png", outputStream);
+            byte[] imageBytes = outputStream.toByteArray();
+            return Base64.getEncoder().encodeToString(imageBytes);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaManager.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaManager.java
new file mode 100644
index 0000000..6a6ab10
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaManager.java
@@ -0,0 +1,15 @@
+package run.halo.comment.widget.captcha;
+
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+public interface CaptchaManager {
+    Mono<Boolean> verify(String id, String captchaCode);
+
+    Mono<Void> invalidate(String id);
+
+    Mono<Captcha> generate(ServerWebExchange exchange, CaptchaType type);
+
+    record Captcha(String id, String code, String imageBase64) {
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaManagerImpl.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaManagerImpl.java
new file mode 100644
index 0000000..7c20373
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaManagerImpl.java
@@ -0,0 +1,64 @@
+package run.halo.comment.widget.captcha;
+
+import java.awt.image.BufferedImage;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import com.google.common.cache.Cache;
+import com.google.common.cache.CacheBuilder;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+import reactor.core.scheduler.Schedulers;
+
+@Component
+@RequiredArgsConstructor
+public class CaptchaManagerImpl implements CaptchaManager {
+    public static final long CODE_EXPIRATION_MINUTES = 1;
+
+    private final Cache<String, Captcha> captchaCache =
+        CacheBuilder.newBuilder()
+            .expireAfterWrite(CODE_EXPIRATION_MINUTES, TimeUnit.MINUTES)
+            .maximumSize(100)
+            .build();
+
+    private final CaptchaCookieResolver captchaCookieResolver;
+
+    @Override
+    public Mono<Boolean> verify(String key, String captchaCode) {
+        return Mono.justOrEmpty(captchaCache.getIfPresent(key))
+            .filter(captcha -> captcha.code().equalsIgnoreCase(captchaCode))
+            .hasElement();
+    }
+
+    @Override
+    public Mono<Void> invalidate(String id) {
+        captchaCache.invalidate(id);
+        return Mono.empty();
+    }
+
+    @Override
+    public Mono<Captcha> generate(ServerWebExchange exchange, CaptchaType type) {
+        return doGenerate(type)
+            .doOnNext(captcha -> captchaCookieResolver.setCookie(exchange, captcha.id()));
+    }
+
+    private Mono<Captcha> doGenerate(CaptchaType type) {
+        return Mono.fromSupplier(() -> {
+                var captcha = switch (type) {
+                    case ALPHANUMERIC -> CaptchaGenerator.generateSimpleCaptcha();
+                    case ARITHMETIC -> CaptchaGenerator.generateMathCaptcha();
+                };
+                var imageBase64 = encodeBufferedImageToDataUri(captcha.image());
+                var id = UUID.randomUUID().toString();
+                return new Captcha(id, captcha.code(), imageBase64);
+            })
+            .subscribeOn(Schedulers.boundedElastic())
+            .doOnNext(captcha -> captchaCache.put(captcha.id(), captcha));
+    }
+
+    private static String encodeBufferedImageToDataUri(BufferedImage image) {
+        var imageBase64 = CaptchaGenerator.encodeToBase64(image);
+        return "data:image/png;base64," + imageBase64;
+    }
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CaptchaType.java b/src/main/java/run/halo/comment/widget/captcha/CaptchaType.java
new file mode 100644
index 0000000..5202383
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CaptchaType.java
@@ -0,0 +1,6 @@
+package run.halo.comment.widget.captcha;
+
+public enum CaptchaType {
+    ALPHANUMERIC,
+    ARITHMETIC
+}
diff --git a/src/main/java/run/halo/comment/widget/captcha/CommentCaptchaFilter.java b/src/main/java/run/halo/comment/widget/captcha/CommentCaptchaFilter.java
new file mode 100644
index 0000000..84e5217
--- /dev/null
+++ b/src/main/java/run/halo/comment/widget/captcha/CommentCaptchaFilter.java
@@ -0,0 +1,155 @@
+package run.halo.comment.widget.captcha;
+
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
+
+import java.net.URI;
+import java.util.Locale;
+import java.util.Optional;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ProblemDetail;
+import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
+import org.springframework.http.converter.json.ProblemDetailJacksonMixin;
+import org.springframework.lang.NonNull;
+import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
+import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.security.web.server.util.matcher.OrServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilterChain;
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.AnonymousUserConst;
+import run.halo.app.security.AdditionalWebFilter;
+import run.halo.comment.widget.SettingConfigGetter;
+
+@Component
+@RequiredArgsConstructor
+public class CommentCaptchaFilter implements AdditionalWebFilter {
+    static final String CAPTCHA_INVALID_TYPE = "https://www.halo.run/probs/captcha-invalid";
+    static final String CAPTCHA_REQUIRED_TYPE = "https://www.halo.run/probs/captcha-required";
+    private final static String CAPTCHA_CODE_HEADER = "X-Captcha-Code";
+    private final static String CAPTCHA_REQUIRED_HEADER = "X-Require-Captcha";
+    private static final String CONTENT_TYPE = "application/problem+json";
+
+    private final ServerWebExchangeMatcher pathMatcher = createPathMatcher();
+    private final ObjectMapper objectMapper = createObjectMapper();
+
+    private final SettingConfigGetter settingConfigGetter;
+    private final CaptchaManager captchaManager;
+    private final CaptchaCookieResolverImpl captchaCookieResolver;
+    private final ServerSecurityContextRepository contextRepository;
+
+    @Override
+    @NonNull
+    public Mono<Void> filter(@NonNull ServerWebExchange exchange, @NonNull WebFilterChain chain) {
+        return pathMatcher.matches(exchange)
+            .filter(ServerWebExchangeMatcher.MatchResult::isMatch)
+            .flatMap(result -> settingConfigGetter.getSecurityConfig())
+            .map(SettingConfigGetter.SecurityConfig::getCaptcha)
+            .filterWhen(captchaConfig -> isAnonymousCommenter(exchange))
+            .switchIfEmpty(chain.filter(exchange).then(Mono.empty()))
+            .flatMap(captchaConfig -> {
+                if (!captchaConfig.isAnonymousCommentCaptcha()) {
+                    return chain.filter(exchange);
+                }
+                return validateCaptcha(exchange, chain, captchaConfig);
+            });
+    }
+
+    private Mono<Void> sendCaptchaRequiredResponse(ServerWebExchange exchange,
+                                                   SettingConfigGetter.CaptchaConfig captchaConfig,
+                                                   ResponseStatusException e) {
+        var type = captchaConfig.getType();
+        exchange.getResponse().getHeaders().addIfAbsent(CAPTCHA_REQUIRED_HEADER, "true");
+        exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
+        return captchaManager.generate(exchange, type)
+            .flatMap(captcha -> {
+                var problemDetail = toProblemDetail(e);
+                problemDetail.setProperty("captcha", captcha.imageBase64());
+                var responseData = getResponseData(problemDetail);
+                exchange.getResponse().getHeaders().addIfAbsent("Content-Type", CONTENT_TYPE);
+                return exchange.getResponse()
+                    .writeWith(Mono.just(exchange.getResponse().bufferFactory().wrap(responseData)));
+            });
+    }
+
+    private byte[] getResponseData(ProblemDetail problemDetail) {
+        try {
+            return objectMapper.writeValueAsBytes(problemDetail);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private Mono<Void> validateCaptcha(ServerWebExchange exchange, WebFilterChain chain,
+                                       SettingConfigGetter.CaptchaConfig captchaConfig) {
+        var captchaCodeOpt = getCaptchaCode(exchange);
+        var cookie = captchaCookieResolver.resolveCookie(exchange);
+        if (captchaCodeOpt.isEmpty() || cookie == null) {
+            return sendCaptchaRequiredResponse(exchange, captchaConfig, new CaptchaCodeMissingException());
+        }
+        return captchaManager.verify(cookie.getValue(), captchaCodeOpt.get())
+            .flatMap(valid -> {
+                if (valid) {
+                    captchaCookieResolver.expireCookie(exchange);
+                    return chain.filter(exchange);
+                }
+                return sendCaptchaRequiredResponse(exchange, captchaConfig, new InvalidCaptchaCodeException());
+            });
+    }
+
+    private static Optional<String> getCaptchaCode(ServerWebExchange exchange) {
+        var captchaCode = exchange.getRequest().getHeaders().getFirst(CAPTCHA_CODE_HEADER);
+        return Optional.ofNullable(captchaCode)
+            .filter(StringUtils::isNotBlank);
+    }
+
+    private OrServerWebExchangeMatcher createPathMatcher() {
+        var commentMatcher = pathMatchers(HttpMethod.POST, "/apis/api.halo.run/v1alpha1/comments");
+        var replyMatcher = pathMatchers(HttpMethod.POST, "/apis/api.halo.run/v1alpha1/comments/{name}/reply");
+        return new OrServerWebExchangeMatcher(commentMatcher, replyMatcher);
+    }
+
+    static class InvalidCaptchaCodeException extends ResponseStatusException {
+        public InvalidCaptchaCodeException() {
+            super(HttpStatus.FORBIDDEN, "验证码错误，请重新输入");
+            setType(URI.create(CAPTCHA_INVALID_TYPE));
+        }
+    }
+
+    static class CaptchaCodeMissingException extends ResponseStatusException {
+        public CaptchaCodeMissingException() {
+            super(HttpStatus.FORBIDDEN, "请先输入验证码");
+            setType(URI.create(CAPTCHA_REQUIRED_TYPE));
+        }
+    }
+
+    ProblemDetail toProblemDetail(ResponseStatusException e) {
+        var problemDetail = e.updateAndGetBody(null, Locale.getDefault());
+        problemDetail.setTitle("Captcha Verification");
+        return problemDetail;
+    }
+
+    static ObjectMapper createObjectMapper() {
+        return Jackson2ObjectMapperBuilder.json()
+            .mixIn(ProblemDetail.class, ProblemDetailJacksonMixin.class)
+            .build();
+    }
+
+    Mono<Boolean> isAnonymousCommenter(ServerWebExchange exchange) {
+        return contextRepository.load(exchange)
+            .map(context -> AnonymousUserConst.isAnonymousUser(context.getAuthentication().getName()))
+            .defaultIfEmpty(true);
+    }
+
+    @Override
+    public int getOrder() {
+        return SecurityWebFiltersOrder.AUTHORIZATION.getOrder();
+    }
+}
diff --git a/src/main/resources/extensions/role-templates.yaml b/src/main/resources/extensions/role-templates.yaml
new file mode 100644
index 0000000..9524cc7
--- /dev/null
+++ b/src/main/resources/extensions/role-templates.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1alpha1
+kind: Role
+metadata:
+  name: comment-widget-public-apis
+  labels:
+    halo.run/role-template: "true"
+    rbac.authorization.halo.run/aggregate-to-anonymous: "true"
+  annotations:
+    rbac.authorization.halo.run/module: "Comment Widget"
+    rbac.authorization.halo.run/display-name: "Comment Widget Public APIs"
+rules:
+  - apiGroups: [ "api.commentwidget.halo.run" ]
+    resources: [ "captcha/generate" ]
+    verbs: [ "get" ]
diff --git a/src/main/resources/extensions/settings.yaml b/src/main/resources/extensions/settings.yaml
index 3939d92..badf54c 100644
--- a/src/main/resources/extensions/settings.yaml
+++ b/src/main/resources/extensions/settings.yaml
@@ -31,6 +31,29 @@ spec:
           key: withReplySize
           validation: required
           value: 5
+    - group: security
+      label: 安全设置
+      formSchema:
+        - $formkit: group
+          name: captcha
+          label: 验证码
+          children:
+            - $formkit: checkbox
+              label: 匿名评论需要验证码
+              name: anonymousCommentCaptcha
+              id: anonymousCommentCaptcha
+              key: anonymousCommentCaptcha
+              value: false
+            - $formkit: select
+              label: 验证码类型
+              if: "$get(anonymousCommentCaptcha).value === true"
+              name: type
+              value: "ALPHANUMERIC"
+              options:
+                - label: 字母数字组合
+                  value: "ALPHANUMERIC"
+                - label: 算术验证码
+                  value: "ARITHMETIC"
     - group: avatar
       label: 头像设置
       formSchema:
diff --git a/src/main/resources/fonts/Arial_Bold.ttf b/src/main/resources/fonts/Arial_Bold.ttf
new file mode 100644
index 0000000..c2eb3dd
Binary files /dev/null and b/src/main/resources/fonts/Arial_Bold.ttf differ