Form Captcha: custom tasks without external services, Yandex SmartCaptcha and Google reCAPTCHA

What this solution does

The form protection module for 1C-Bitrix allows implementing CAPTCHA without mandatory reliance on external services. You can choose custom tasks: assembling a puzzle from image fragments, solving an arithmetic example, or entering an answer to a question set by the site administrator. These options do not require a provider account and incur no additional fees per check. The GD library must be available on the server for puzzle functionality. Arithmetic tasks and questions can be solved programmatically. For forms with a high risk of automated submissions, it is recommended to connect Yandex SmartCaptcha or Google reCAPTCHA versions 2 and 3.

The answer verification is performed on the server side before saving the request or sending a message to connected handlers. The system allows remembering a successful check for a specified period and viewing rejection reasons in the event log. Before installation, protection must be connected to the form handler. Integration with certain components and non-standard AJAX forms may require developer assistance. Adding a form to the module registry does not replace the need for server-side integration.

Integration with Yandex SmartCaptcha and Google reCAPTCHA

Select an external service in the module settings and enter the corresponding keys. Yandex SmartCaptcha and Google reCAPTCHA versions 2 and 3 are supported. Google version 3 operates without displaying a visible task to the user.

Keys must correspond to the selected captcha type and the site domain. The module stores one key pair for each Google version: keys for version 2 are not compatible with version 3, and vice versa.

Usage terms, quotas, and potential costs for the external service are determined by the provider and are not included in the module price. Current terms are available on the official Yandex SmartCaptcha and Google reCAPTCHA resources.

Reduced number of repeated checks

Successful verification can be remembered for a specified period for a specific form and a specific visitor. This reduces the number of repeated tasks. Remembering that a visitor has passed verification does not limit the number of separate submissions that the verified visitor can make.

Management of connected forms

The registry displays forms for which protection is enabled. Settings are separated by site. For supported scenarios, the standard captcha can be replaced without modifying the Bitrix core or the provider's components.

Bitrix web forms and registration: early server events.

For main.feedback and Intec Startshop systems, verification is performed in the site code before the corresponding component is called.

The topman.captcha module provides CAPTCHA verification for forms without relying on external services, supporting custom tasks, Yandex SmartCaptcha, and Google reCAPTCHA.

The topman.callbackform adapter operates within the site's own template, utilizing a custom PHP handler to validate data before the first save or email dispatch. Settings are available in the Top Man Digital → CAPTCHA section, containing tabs for Status, Forms, CAPTCHA, and Log. Detailed connection instructions are provided on the Installation tab.

The Log serves diagnostic purposes by displaying reasons for rejected submissions and allowing verification of connected forms. It can be configured to record only blocks or all events. The log does not store submission content, CAPTCHA answers, or secret keys.

The module operates independently; installing topman.antibot is not required. topman.captcha is responsible solely for CAPTCHA verification; hidden anti-bot checks, text filtering, block lists, and submission rate limiting are outside its scope. Each form should utilize a single active CAPTCHA.

To verify functionality during the 21-day demo period, connect one form to a test site copy, then select either a custom task or an external service. Confirm that no submission or email is created when the response is missing or incorrect. Ensure that a single submission is created and one intended action is executed upon successful verification.

Before deployment, test AJAX functionality, form reopening, and mobile device compatibility.

System Requirements and Compatibility

Requires PHP 8.2 or newer, MySQL or MariaDB database with the InnoDB engine, and browser support for JavaScript and cookies.

The puzzle feature requires the GD library. For external services, valid access keys and HTTPS connectivity from both the server and the browser are required.

Integration with non-standard AJAX handlers requires separate configuration. The CAPTCHA_COMPATIBILITY mode is no longer supported.

Verified versions include PHP 8.3.36, Bitrix main 26.150.0, form 26.0.0, Intec Startshop 1.0.3, and topman.callbackform 1.0.3. Other versions and handlers require individual verification.

Field validation, consent checks, and other original form validations are preserved. If an external service is unavailable, the check is not bypassed; the user is prompted to retry. If the module is disabled or unavailable, the integration code must return the standard CAPTCHA or block data submission until the application is saved.

For the “Form Captcha: custom tasks without external services, Yandex SmartCaptcha and Google reCAPTCHA” module, General iT can perform installation, configuration and a functional check in your project.