How to Protect your Drupal Forms against Bots? Review of the Captcha Module

February 11, 2025 / By

When publishing a form on your website, you must be aware that sooner or later spambots will find it. It is one of the biggest scourges of the modern Internet. The Captcha module will protect you against such situations.

Further down the article, I will present the instructions for using the module and its potential possibilities. This is essential knowledge that we use in practice as part of the Drupal development services provided by Droptica.

Dates

The first version of the module was released in May 2005 for Drupal 4. Developing the version for Drupal 8 took many years. The first try-outs took place in 2013, but the première of a stable version took place only at the beginning of 2020.

Module’s popularity

Captcha is a popular and appreciated module. According to official statistics, it is used by almost 300,000 Drupal-based websites. The latest version from the 8.x-1.x branch is installed on 80,000 websites. The module’s popularity is gradually decreasing – probably due to the transition to other, more modern solutions.

Module’s creators

The Captcha module has five maintainers; they are Jakob Perry (Acquia and Lanfest), Fabiano Sant’Ana (Chuva Inc.), Lachlan Ennis (Expert1 Pty Ltd), Naveen Valecha (Acquia) and Andrii Podanenko (Open Y and ITCare). They are all very active and valuable members of the Drupal community. The official sponsor of the module is the Chuva Inc. company. The code repository consists of 606 commits by almost 120 users.

What is the module used for?

The Captcha module is used to protect forms against spam; it helps you ensure that the website’s visitor is not an Internet robot. There are many ways to check the user’s authenticity (such as reCaptcha) – they are delivered as dependent modules. By default, you can use a simple math challenge that will lock the form if the person completing it fails to add two numbers.

Unboxing

You can download the Captcha module at https://www.drupal.org/project/captcha.

After enabling the Drupal module, the only necessary step is to select the forms you want to cover by protection. Go to the module settings by selecting “Configuration → People → CAPTCHA module settings“ and select the “Form settings” tab. Find your form there and enable it by clicking on the “Enable” button.

If the form is not on the list, add it by clicking the “Add captcha point” button and enter form_id. The effect of the module for the user login form looks like this:

Module’s use

The Captcha module has several advanced settings that allow you to customise the protection of your websites better. The most important ones are:

• Default challenge type – the ability to choose the type of a “trap”, by default it is a mathematical operation. External modules provide other types.
• Default challenge on non-listed forms – a radical solution that enables protection for all forms that are not listed in the “Form settings” list.
• Add CAPTCHA administration links to forms – a very useful option that allows you to manage the type of security directly from the given form. It saves a lot of time on complicated websites.
• CAPTCHA placement caching – cache clearing, useful in the case of problems with forms.
• Add a description to the CAPTCHA – adding a description explaining why the user needs to prove that they are not a bot.
• Case sensitive/insensitive validation – determining whether there will be a distinction between uppercase and lowercase letters in solving the “puzzle” presented to the user.
• Persistence – the ability to disable protection in certain special cases, e.g., when the user has previously confirmed their authenticity.

Hooks and integrations

Captcha provides two hooks to integrate Drupal modules that verify users. These are:

• hook_captcha() – the main hook used to define your own submodules; it has a structure known from Drupal 7 (it transmits the $op variable containing the type of the currently performed operation).
• hook_captcha_placement_map() – optional hook specifying the place in the form that should be modified.

This is where the real power of the module lies. At drupal.org, you can find a number of projects that implement various verification methods:

• reCAPTCHA – to support the most popular verification services available, provided by Google.
• Image CAPTCHA refresh – this module is an integral part of Captcha for Drupal 8; for Drupal 7 it functions as a separate project. It introduces a widget with an image from which one has to rewrite a text.
• CAPTCHA Pack (alpha version only) – a collection of very interesting “traps” for bots, including completing a missing letter or word in a sentence.
• Text CAPTCHA (Drupal 7 only) – integration with the textcaptcha.com website.
• Captcha Riddler – allows you to define your own set of puzzles for the user.
• Hidden CAPTCHA (Drupal 7 only) – cheats bots by inserting an invisible field that blocks the form from being sent.
• CAPTCHA after (Drupal 7 only) – only runs Captcha after the user has submitted the form multiple times.
• KeyCAPTCHA (Drupal 7 only) – integration with the keycaptcha.com website.
• Draggable CAPTCHA (Drupal 7 only) – a drag & drop puzzle, no dependence on external websites.

Summary

The main arguments behind the module are the effectiveness and simplicity of implementation. It is perfect for fighting against Internet spammers.

We also use it in our Drupal agency as a tool that fits every form and does not require additional coding.