reCAPTCHA V3 - Trial Results So Far

[ColinM]

Ok, I applied the V3 to an update on one of my Client;s sites that has three forms - mailing list, wine order form and contact us across three of their pages.

I left the settings at a std 500.

I've just done some testing (I have myself as a BCC in the Autoesponder) - typing in my details and submitted - and received a message that I had been detected as a Bot.

I've temporarily removed the captcha and will conduct some more tests.

[ALWAYSLEARNING]

I am having problems using recaptcha v3 and v2. I am not sure if it is an operator's error of if some custom coding is required to get the tool to work.
I would rather use v3 if possible, but I would settle for v2 if I can get it to work.

I integrated/included the recaptcha inside the form. I published it, but when I tested it online, I was able to press on the submit button. Basically, I was able to bypass the recaptcha. Other problem was that after submitting the form, I was automatically redirected to the error page. Clearly, something is wrong with my process.

I haven't been able to figure out how to solve this issue, so any pointers would be greatly appreciated.

[ColinM]

Hi ALWAYSLEARNING,

Yes, I've had some unpredictable results with V3. Placed on one of my Clients websites it said I was a bot. So I removed it. I have some mixed feelings about using V3 - those that I respect have said they like something in the form submitters face and it could easily be justified that it gives the legitimate submitter some peace of mind.

So I'm going back to V2 (I'm not a robot).

When you said you could submit the form without the captcha - was that V2 or V3? - V3 does everything in the background so you are not bypassing it as such.

[ALWAYSLEARNING]

Hi ColinM,

Actually both v2 and v3 allowed me to click on the submit button, thus bypassing the recaptcha form. The submit button should only be active once the recaptcha tool verified the "challenge". I initially thought it would be as simple as dropping the tool into the form, and fill out the required infos.

I have both a subscribe and a contact form on the same page, and I wasn't sure if having two recaptchas would cause some sort of a conflict. Unfortunately, I am not even able to get one running correctly.

v3 would be a good option in order to minimize user interaction with the forms ( too many variables in v1 and v2 causing all kinds of headaches).

If you don't mind me asking, how did you get v2 to work with your form?

This is what I did:
I created a simple form using the wizard. One included a name/email/subscribe button. the contact form has a name/email/message/submit button (data was required for all input).
Once the forms were created, I included the recaptcha with the keys and linked the success/error pages. I also made sure to place the recaptcha tool before the buttons.

Something must be missing in my settings to constraints the submit button to be activated only after the quiz or challenge has been solved ( at least for v2). I left the data fetch on the recaptcha to file_get_contents; maybe it should be set to cURL. I will have to contact my host provider and check with them. v3 behaved the same way; if I am not mistaken, it should disable/inactive the submit button by default until one checks the mark, then one should be able to press on the submit/send button.

[ColinM]

Hi ALWAYSLEARNING,

Actually both v2 and v3 allowed me to click on the submit button, thus bypassing the recaptcha form. The submit button should only be active once the recaptcha tool verified the "challenge". I initially thought it would be as simple as dropping the tool into the form, and fill out the required infos.

You are right and I agree. Though clicking the submit without "click ticking" the "I'm not a robot"sent me to the forms error page.

I have both a subscribe and a contact form on the same page, and I wasn't sure if having two recaptchas would cause some sort of a conflict. Unfortunately, I am not even able to get one running correctly.

You can only have one form on a page.

v3 would be a good option in order to minimize user interaction with the forms ( too many variables in v1 and v2 causing all kinds of headaches).

I agree, it would be a good option, but I've found it too unpredictable.

If you don't mind me asking, how did you get v2 to work with your form?...

One form per page would be a good start and make sure you have and use success and error pages.

[ALWAYSLEARNING]

Hi ColimM,

If pressing the form button sends you to the error page without ticking the recaptcha tool, then IMHO, I would attribute that to a step missing in the set up process. That is exactly what happened to me.

If I am understanding you correctly, you have successfully integrated v2 into your form. Did you use the automatic or explicit render code in your page? I used the automatic render, but I am still having the same problem with recaptcha not preventing the submit button from being active before ticking the check mark radio button.

Don't take my word for it, but I believe you can have more than one form on a page. I don't really know how many people use more than one form on their websites, but in my case I would prefer to have both the subscribe and contact form on the same page, instead of using two different pages for each form ( especially if accessing the web from a phone).

I did set up two success and error pages for both the subscribe and contact forms.

I will work on trying to resolve this recaptcha issue tonight, and see what I can come up with.

Thanks!

[ColinM]

Hi ALWAYSLEARNING,

If pressing the form button sends you to the error page without ticking the recaptcha tool, then IMHO, I would attribute that to a step missing in the set up process. That is exactly what happened to me.

To be honest, I'm not sure about that. I'd have to do some research when I have some more time.

If I am understanding you correctly, you have successfully integrated v2 into your form. Did you use the automatic or explicit render code in your page? I used the automatic render, but I am still having the same problem with recaptcha not preventing the submit button from being active before ticking the check mark radio button.

By that if you mean the form construction, then it would be using the built in PHP script.

Don't take my word for it, but I believe you can have more than one form on a page. I don't really know how many people use more than one form on their websites, but in my case I would prefer to have both the subscribe and contact form on the same page, instead of using two different pages for each form ( especially if accessing the web from a phone).

I did set up two success and error pages for both the subscribe and contact forms.

I thought I'd read recently a post from Pablo that you can only have one form per page - but I may be wrong and hopefully I'm not misquoting Pablo.

[ALWAYSLEARNING]

Hi ColinM,

Sorry couldn't get back with you sooner. Anyway, going back to what I said yesterday; the submit button should only be activated once a user checks the recaptcha radio button (v3) or solve the puzzle(v2). There ought to be some link between the recaptcha tool and the submit button. I hope someone on the forum can chime in and tell us how they integrated the recaptcha tool.

I agree, the form is php based, but I was talking about the automatic/explicit render which is a widget (from Google) I included in the html page. You can find it in the recaptcha dashboard. Again, it didn't make a difference, so clearly I need to do more research on how to solve this problem.

If you said that you read that Pablo said that only one form is allowed per page, then I'll have to stick with one form. I will have to duplicate the masterpage, and include one of the forms in it.

Regards

[ColinM]

Hi ALWAYSLEARNING - Yes, I agree that there should be ability to real time verify completion of the reCAPTCHA V2. I use bootstrap validation, but I haven't yet found a way to generate a bootstrap validation on the Captcha.

[ALWAYSLEARNING]

Hi ColinM,

This is how the form behaves right now; if I skip the recaptcha then I get the error page message. When I go back to the form and check the recaptcha radio button, then it validates and I am then sent to the success page. That is not the way recaptcha should work.

If you get the bootstrap validation on the captcha working, then I may have to switch to that method too. I will look into it a little bit more in the morning, and I''ll see what I can come up with.

Thank you!

[ALWAYSLEARNING]

Hi ColinM,

Ok, some update here regarding recaptcha. I am not sure if Pablo visits the form forum subsection or not. I was told by one of tech support from my host provider that the recaptcha plugin may be the root cause. Again, I remain open minded on this issue, meaning that I need to ask Pablo if there is a setting that I may have overlooked or one that may need to be added to the recaptcha tool to connect it to the submit button.

I added a notice/text line above the recaptcha tool saying that not checking the tool will give an error. Question: I don't know if it will prevent bots from spamming the mail box or not.

The landing page has now two forms(index+masterpage), and one recaptcha. I will need to investigate to see if I can add another recaptcha for the second form (the naming convention would probably have to be very concise).

So far so good, but one can't be too sure until the site is tested by the visitors.

[ColinM]

Hi ALWAYSLEARNING,

Thanks for the update. Yes, I took a similar approach, putting a please make sure you click/tap to tick the "I'm Not a Robot".

The Captcha will stop Bots (auto fillers) but not spammers that sit there and fill in forms.

Yes, Pablo does go across all the threads, as best as genius, single person human dynamo can.

I'll try and get a chance to raise the issue with Pablo in an email and let you know what he comes back with.

[ALWAYSLEARNING]

Hi ColinM,

Hopefully, this whole spamming business may come to an end at some point, but I doubt that it will happen anytime soon. In the meantime, we can only hope that tools like recaptcha can become more robust to help deter all those spammer wannabees.

Thanks for trying to escalate the issue with Pablo. At this moment, I can live with the current set up, and I will certainly revisit it very soon for the other website I am currently building.

Best Regards,

[ColinM]

Hi ALWAYSLEARNING,

Hi ColinM,

Hopefully, this whole spamming business may come to an end at some point, but I doubt that it will happen anytime soon. In the meantime, we can only hope that tools like recaptcha can become more robust to help deter all those spammer wannabees.

Don't hold your breath, unless you are prepared to (literally) face the colour dark blue.

Thanks for trying to escalate the issue with Pablo. At this moment, I can live with the current set up, and I will certainly revisit it very soon for the other website I am currently building.

I was going to actually escalate it with Pablo anyway, for my own benefit. I believe there may be a way to add code - but I'm incrementally stuying both the forms ability to accept additional code (doable) and the right code from Google Developers suite.

I'm of the opinion that Google documenters actually have Master Degrees on how NOT to write instructions/documentation/information.

[basstuuk]

as long as there is a revenue model for spammers, it will not stop.
And there are still thousands of spammers who are filling out forms manually
Apparently nothing else to do

[ColinM]

as long as there is a revenue model for spammers, it will not stop.
And there are still thousands of spammers who are filling out forms manually
Apparently nothing else to do

All very true basstuuk.

Hi ALWAYSLEARNING,
As I said I would, I contacted Pablo and here's his response. No doubt one of the many things to look forward to with 16!

Hi Colin,

I sorry, there is no validation option for reCAPTCHA.
However, the next version (16) will have built-in reCAPTCHA support with more options.

Best regards,
Pablo

[ALWAYSLEARNING]

Hi Basstuuk,
Agree, I don't see any resolution a this point, but one can only hope that better tools will be available in the future to minimize this problem.

Hi ColinM,
Thank you for checking with Pablo! I am glad to hear that there will a setting that would make the plugin easier to use. We can simply be patient until version 16 is released.

[ColinM]

Hi ALWAYSLEARNING,

You're very welcome.

[Magical]

I don't know if this helps but I removed the captcha and recaptcha from all my sites. Instead I added a field like 'city ' which is blank and hid it behind a button. If the spammers are using a script they invariably fill the field with some city name. In my php i simply look for city to be blank and and send the email to a spam folder. You should not create it as a hidden field, but create an actual field and hide in the rendering, also turn off the auto fill for it. Some scripts are able to weed out 'hidden' fields on the form.

Secondly, ask your customer to add privacy to the Domain record. I find a lot of the spammers get their data from the public domain records using a whois - captcha appears to be easy to bypass. This has reduced the spam we were getting significantly.

Third - add the check for URLs (now its part of wysiwygwebbuilder). I do not allow URLs in the message or in any field. I have not used the MX record check, but I believe that should help cut down the noise.

Keep building awesome sites using wysiwygwebbuilder!

[ColinM]

Hi Magical,
Thank you very much for your input and the time you devoted to that.
Interesting idea on the form.
I certainly agree with the public domain record.
That's why my contact details go in both the Registrant and Technical Support details.