1C-Bitrix Anti-Spam: Invisible reCAPTCHA v3 Integration Guide

We integrate Google reCAPTCHA v3 into 1C-Bitrix to provide invisible anti-spam protection. Spam through website forms is a real headache. A contact form receives 500 bot submissions daily, the sales department drowns in junk, CRM gets cluttered. The standard Bitrix captcha module (bitrix:main.captcha) uses its own implementation that modern bots bypass effortlessly. On one project, the client lost up to 70% of manager time filtering spam. After implementing Google reCAPTCHA v3, spam volume dropped by 95%, and form conversion improved by 12% — users no longer had to bother with captcha. Cost savings estimated at $5,000 per month for a mid-size e-commerce site. We developed a solution based on Google reCAPTCHA v3: it protects forms without annoying tasks, with server-side verification and logging.

Comparison of reCAPTCHA v2 and v3

reCAPTCHA v3 is 3x more effective for UX than v2, as per Google reCAPTCHA documentation. It performs invisible verification and returns a score from 0.0 (bot) to 1.0 (human) without interrupting the user. Recommended threshold: score >= 0.5. Logic: if score < 0.5, you can display v2 as an additional challenge or block the submission. In practice, v3 is better for high-traffic projects where every click matters.

Why reCAPTCHA v3 is better for Bitrix?

First, it does not annoy users — verification happens in the background. Second, it is adaptive: when suspicious behavior is detected, you can fall back to v2. Third, Google continuously updates algorithms, offering protection without extra development. For e-commerce sites on 1C-Bitrix, this reduces cart abandonment: users are not distracted by captcha. Savings on spam processing costs can reach 90%.

According to Google reCAPTCHA documentation, reCAPTCHA v3 is three times more effective for UX than v2 and does not require manual confirmation. This is especially important for mobile users.

How to integrate reCAPTCHA with 1C-Bitrix?

Key registration

In the Google reCAPTCHA console register your domain and obtain two keys:

• Site key — public, inserted into frontend.
• Secret key — private, used for server verification. Store in COption or .env, not in code.

Step-by-step setup

grecaptcha.ready(function() { grecaptcha.execute('SITE_KEY', {action: 'submit'}).then(function(token) { document.getElementById('g-recaptcha-response').value = token; document.getElementById('feedback-form').submit(); }); }); 

function verifyRecaptcha(string $token): bool { $secretKey = COption::GetOptionString('site', 'recaptcha_secret'); $http = new \Bitrix\Main\Web\HttpClient(); $response = $http->post('https://www.google.com/recaptcha/api/siteverify', [ 'secret' => $secretKey, 'response' => $token, 'remoteip' => $_SERVER['REMOTE_ADDR'], ]); $result = json_decode($response, true); return $result['success'] === true && ($result['score'] ?? 0) >= 0.5; } $token = $_POST['g-recaptcha-response'] ?? ''; if (empty($token) || !verifyRecaptcha($token)) { $APPLICATION->ThrowException('Verification failed. Please try again.'); return; } 

Setup for multiple forms

If the site has several forms (contact, subscription, quick order), it is easier to put the verification in an event handler onBeforeResultAdd. This way the check code is unified for all forms, and exclusion logic is configured via form identifier. Example:

// in init.php or custom handler AddEventHandler('form', 'onBeforeResultAdd', array('MyRecaptchaHandler', 'onBeforeResultAdd')); 

How to configure block logging?

Write blocked attempts to a table via \Bitrix\Main\Application::getConnection()->query():

CREATE TABLE IF NOT EXISTS b_spam_log ( ID int AUTO_INCREMENT PRIMARY KEY, DATE_CREATE datetime, IP varchar(45), SCORE float, FORM_ID varchar(50), ACTION varchar(50) ); 

Analyzing logs over a week reveals attack patterns — peak hours, IP ranges, targeted forms. Based on that, configure additional rules at nginx level or add to blacklist. Logging also helps detect false positives and adjust the score threshold.

Case study: false positives

Our client was a corporate portal. Users complained they could not submit a request form from the office. Cause: corporate proxy — all traffic from a single IP. Google reCAPTCHA gave these requests a low score due to anomalous pattern. Solution: for authenticated users (B2B cabinet), reCAPTCHA was not applied — we check $USER->IsAuthorized() and skip verification. After the fix, false positives disappeared.

What is included in the work

Integration is delivered turnkey in 1–2 days. We guarantee correct operation. Our team has 5+ years of Bitrix development experience and has completed over 50 anti-spam integrations. Get a free project evaluation — we will assess your project at no cost. Order spam protection for your forms today.