reCAPTCHA

Put a Google reCAPTCHA checkbox in front of the submit button so a bot has to solve a challenge before a submission is accepted.

reCAPTCHA is Google's test for telling a person from a script. Tinyform offers it as a block: you drop it into the form, the published page draws the "I'm not a robot" checkbox, and a submission is only accepted once the checkbox has been solved and Google has confirmed the answer. The version used is the Challenge (v2) checkbox.

A published form with a name, an email and the reCAPTCHA checkbox above its submit button

How it works

In the editor, open the insert menu and pick reCAPTCHA from Advanced blocks (/recaptcha on an empty line finds it too). Place it directly above the submit button. The block's own description says the same: protect your form from spam and bots, and add it right above Submit.

Typing /recap on an empty line, with reCAPTCHA offered under Advanced blocks

The canvas draws the real widget, and you can tick it there. That is deliberate: it is the one way to see that the check really works before a respondent finds out that it does not. Ticking it on the canvas costs nothing and sends nothing.

Publish the form and the check is live. Every respondent has to tick the box before the form can be sent.

The published page drawing the I'm not a robot checkbox above Submit

When Google's risk analysis is unsure, the tick opens a picture challenge, and the form can only be submitted after it has been passed.

Google's picture challenge open over the form after the checkbox was ticked

A submission that arrives without a valid solution is refused with the message "Please confirm you're not a robot and try again." If Google cannot be reached at that moment, the submission is refused too, with a request to try again shortly, rather than let through unchecked.

What the check covers

The proof of a solved challenge travels in its own request header and is checked on the server. It never becomes part of the answers: it is not in the submission, the CSV export, a webhook payload or Insights. What a solved token proves is that a person solved a challenge on this site; each token can be spent once and lives for two minutes, which is what makes automated submission expensive.

Accessibility

Google's widget works with the major screen readers, including ChromeVox, JAWS, NVDA and VoiceOver, and announces its state changes, such as a failed or completed challenge.