Smart captcha, spam and bot protection

What this solution does

Intelligent CAPTCHA module for protecting forms from spam and automated attacks. The system operates on a proprietary engine independent of external services like Google or Yandex. It includes 12 distinct verification types, offers developers a complete API, and supports 9 design themes.

The standard 1C-Bitrix captcha is outdated. Modern neural networks recognize distorted characters more effectively than humans, rendering traditional protection methods ineffective. This creates a dilemma: a captcha that is too simple allows spam through, while one that is too complex drives away real users who cannot complete the form.

The luxar.captcha module provides a solution as an autonomous spam and bot protection system. The system operates exclusively on your server, sending no requests to external networks. This eliminates the need for additional payments and fully complies with the requirements of Federal Law 152-FZ.

The system employs 12 types of visual tests. Random selection from this set prevents bots from memorizing and bypassing a specific verification type.

Administrators can manually select active captcha types or enable 'auto' mode for maximum unpredictability in protection.

The module performs behavioral analysis based on seven key signals before displaying the test. The system evaluates mouse movement irregularity, time spent on the page, touch screen availability, Canvas fingerprint, scrolling behavior, typing patterns, and click patterns. Since bot behavior is predictable, these indicators are detected before the test begins. The resulting score (0–100) is logged and factored into the final decision.

A complete API is available for developers. Full documentation with code examples in Russian is published on the developer's website.

Includes 9 ready-made themes and the option to create a custom one. The widget automatically adapts to the design of any website. In 'Custom Theme' mode, settings allow adjusting the background color, text color, accent color, border, border radius, and shadow, with real-time preview.

The set includes six thematic SVG robots. After successfully completing the verification, the widget displays an animated character tailored to your specific niche. This transforms the CAPTCHA into a user experience element rather than a frustrating barrier.

Multi-level protection against bots and spam

The system employs a hidden honeypot field that instantly blocks automated requests before any test is displayed. Behavioral analysis evaluates activity based on seven browser signals, generating a score from 0 to 100 with a configurable threshold. Visual verification includes 12 types of challenges selected randomly; bypassing them without machine learning is impossible. When suspicious activity is detected, the system automatically escalates the difficulty of the test.

To prevent overload, AJAX request rate limiting is enforced at 20 requests per minute per IP address. Automatic IP blocking triggers upon exceeding the attempt limit, while administrators retain full manual control over the block list. Generated tokens are single-use, becoming invalid after verification or upon expiration of their limited lifespan.

Administrative panel

Settings: each site has a dedicated tab with real-time widget preview capabilities.

Statistics: a detailed log records the test type, score, IP address, page, and result for every attempt, with filtering and export options available.

IP block list: allows viewing, adding, and removing blocks manually, including the specification of a reason.

Tokens: displays a list of active tokens with the ability to manually invalidate them.

Comparison with competitors

Smart Captcha is the only solution that uses a proprietary engine, a full API, and thematic robots.

All data remains on your server. Neither behavioral signals, IP addresses, nor test results are shared with third parties. The solution fully complies with 152-FZ regulations.

Frequently Asked Questions

Is a Google or Yandex subscription required?

No. The module operates entirely on your server; no external keys or subscriptions are needed.

Does the module comply with 152-FZ requirements?

Yes. User data is never transmitted outside your server.

Does it work with AJAX forms and custom components?

Yes. Any form can be protected using manual mode (PHP API + JS API).

What happens when Bitrix is updated?

The module uses standard Bitrix events, ensuring compatibility is maintained during updates.

Can captcha be disabled for specific pages?

Yes. In automatic mode, set the LUXAR_CAPTCHA_SKIP_AUTO constant in the template of the required page.

General iT can install and configure this module and check how it works on your website.