BX365: Enhanced CAPTCHA for 1C-Bitrix (CAPTCHA for protecting forms from spam)

What this solution does

The module enhances the standard 1C-Bitrix CAPTCHA to protect forms from spam, direct image parsing, and automated bot bypass attempts. Instead of immediate rendering, it implements secure lazy loading: the CAPTCHA is generated and loaded only after user interaction. The image is dynamically sliced into fragments and assembled in the browser, which complicates automated code extraction and reduces unnecessary generation. The solution remains fully compatible with the native 1C-Bitrix verification system and does not require third-party services such as reCAPTCHA or Yandex SmartCaptcha. This approach minimizes external integrations, prevents visitor data transfer to third parties, and simplifies compliance with personal data protection laws, including Federal Law No. 152-FZ.

The BX365 Enhanced CAPTCHA module is designed for 1C-Bitrix sites where the standard protection fails to handle spam in contact forms, registration, comments, and reviews. The solution is compatible with popular ready-made templates from developers such as Aspro, Sobit, INTEC, Simai, MC Art, ALFA Systems, Nextype, and others.

The module's functionality replaces the standard CAPTCHA with an enhanced version. The image loads lazily, only after user interaction with the form. Visual protection is built by dynamically slicing the image into irregular parts, which are then reassembled in the browser using the canvas technology. This prevents direct access to the original CAPTCHA image.

Additional mechanisms are implemented to complicate automated bypassing: display timeout, a progress bar, a flickering parts mode, and random rotation of parts upon loading. Administrators can customize the appearance of the CAPTCHA block and the refresh button, as well as define exclusions by domain and site. Built-in tools allow for error logging and automatic cleanup of temporary files.

The module settings include an option to fully disable the extension. When activated, the enhanced protection stops working, and the site reverts to the standard 1C-Bitrix CAPTCHA without replacement.

Enable error logging — records module technical errors to a log file. This feature is useful for diagnosing issues with CAPTCHA loading or display.

Allow direct access to CAPTCHA image in public part — when disabled, the module makes it harder to retrieve the standard CAPTCHA image directly via /bitrix/tools/captcha.php. For maximum protection, it is recommended to keep this setting disabled.

Do not destroy the verification code after CAPTCHA timeout (disappearance) — if enabled, the module will not destroy the verification code after the display time expires. This is useful if the user has already entered the code but did not have time to submit the form before the image disappeared.

Do not replace CAPTCHA for domains — allows disabling CAPTCHA replacement for specific domains. Each domain should be entered on a new line.

Do not replace CAPTCHA for selected sites — allows disabling CAPTCHA replacement for selected sites in multi-site mode.

Do not display individual CAPTCHA settings for selected sites — hides the individual CAPTCHA settings tabs for the specified sites.

Clear file cache: removes temporary files generated by the module. This function is used for manual cache clearing during debugging or site maintenance.

CAPTCHA block styling settings:

Block width — sets the width in pixels.

Block height — sets the height in pixels.

Mobile width — sets the width in pixels for mobile devices.

Mobile height — sets the height in pixels for mobile devices.

Corner radius (px) — sets the corner rounding radius in pixels.

Border color — defines the block border color.

Background color — sets the block background color.

Text color — sets the color of the service text inside the block.

Error text color — defines the color of the error message.

Text size (px) — sets the size of the service text in pixels.

Error text size (px) — sets the size of the error message text in pixels.

Timeout duration (ms) — defines how long the loaded CAPTCHA remains visible to the user, specified in milliseconds.

Progress bar color setting for the countdown timer until CAPTCHA expiration.

CAPTCHA refresh button styling:

Set the width and height of the refresh button in pixels for the desktop version.

Set the width and height of the refresh button in pixels for mobile devices.

Define the corner radius of the refresh button in pixels.

Select the border color for the inactive button state.

Select the border color for the active state or on hover.

Select the background color for the inactive button state.

Select the background color for the active state or on hover.

CAPTCHA loading and cropping parameters:

Dynamic image slicing settings for CAPTCHA. Available slicing methods include random, horizontal, vertical, rectangular grid, and square grid. Users define the minimum and maximum number of segments into which the image can be divided. The delay between loading individual segments is configurable in milliseconds.

A flickering mode is implemented to complicate automated recognition. Options include display without flickering or with flickering segments. Configuration allows setting the number of simultaneously flickering segments and the interval for changing overlapping segments, specified in milliseconds.

Overlay segment color — sets the color of overlay elements used in flickering mode.

Overlay segment transparency — configures the opacity of overlay elements used in flickering mode.

CAPTCHA segment rotation mode:

Random rotation on load — determines whether a portion of CAPTCHA segments is temporarily displayed in a random orientation upon image loading. Once rendered on the canvas, these segments rotate to their correct position. The effect occurs only during CAPTCHA loading and does not represent continuous rotation.

Maximum number of rotating segments — defines the maximum count of CAPTCHA segments that can be temporarily displayed in a rotated state during image loading.

Delay before segment rotation (ms) — sets the base delay before a segment begins rotating to its correct position. The value is specified in milliseconds.

Segment rotation duration (ms) — defines the animation time required for a rotated segment to return to its correct position. The value is specified in milliseconds.

Custom CSS:

The module allows adding individual CSS rules for the current site. This setting helps adapt the layout and styling of the CAPTCHA to the specific site template. CSS code is entered separately for each site in multi-site mode without using style tags. User styles are loaded after the module's base styles and are used to adjust the display of the CAPTCHA and form elements within a specific template.

After installation, the module works automatically and replaces the standard CAPTCHA in the public part of the site. The CAPTCHA image is loaded lazily: it is not generated immediately upon page load but is requested only after user interaction. This approach reduces unnecessary CAPTCHA generation during bot and scanner visits.

The CAPTCHA image is sliced into parts and assembled in the browser via canvas. Depending on the settings, parts may load with a delay, display with flickering, or briefly appear in a random orientation before rotating to the correct position.

When the flickering and random rotation of segments are enabled simultaneously, the segments undergoing rotation are temporarily excluded from the flickering effect until the rotation completes. This approach preserves the readability of the CAPTCHA and minimizes visual noise.

Important: The module enhances the standard 1C-Bitrix CAPTCHA and increases the difficulty of automated form bypasses, but it does not guarantee absolute protection against all types of bots and spam.

General iT can connect “BX365: Enhanced CAPTCHA for 1C-Bitrix (CAPTCHA for protecting forms from spam)”, configure it and verify the integration with the existing website.