CAPTCHA Setup in 1C-Bitrix
CAPTCHA in Bitrix is primarily needed on registration, login, and contact forms — wherever bots create junk accounts or flood the mail queue. By default, the built-in CAPTCHA is disabled, and enabling it requires choosing the right type for the specific use case.
Built-in CAPTCHA and reCAPTCHA
Bitrix supports two options:
Built-in CAPTCHA — generates a server-side image with characters. Does not require external services, works offline. Enabled under Settings → Main Module → CAPTCHA. Downside: easily bypassed by modern recognition tools.
Google reCAPTCHA v2/v3 — integration via the main module. Setup:
- Register your site at google.com/recaptcha
- Obtain a Site Key and Secret Key
-
Settings → Main Module → CAPTCHA → Type: reCAPTCHA - Enter the keys
reCAPTCHA v3 runs in the background (no user interaction required) and returns a risk score (0.0–1.0). v3 support in Bitrix is available from version 22.0 of the main module.
Adding CAPTCHA to Components
Built-in Bitrix components support CAPTCHA via parameters:
-
bitrix:main.register— parameterUSE_CAPTCHA = Y -
bitrix:main.login— parameterUSE_CAPTCHA = Y -
bitrix:form(web forms) — checkbox in form settings:Use CAPTCHA -
bitrix:sale.basket.basket— CAPTCHA at checkout (if enabled)
For custom forms, use the class \Bitrix\Main\Security\Captcha\CaptchaManager (the main module, available since Bitrix D7).
Real-World Case
A news portal with a comment form. Without CAPTCHA, 500–2,000 spam comments accumulated overnight — bots had discovered the endpoint. The mail queue (b_event) was flooded with notifications. Solution: integrating reCAPTCHA v2 into the comment component. The custom component required manually adding a call to CCaptcha::IsCaptchaValid() in the form handler. Spam dropped to zero.
Alternative: Honeypot
For forms where CAPTCHA hurts conversion (inquiries, callback forms), use honeypot fields — hidden fields that bots fill in but humans do not. Implemented in init.php via a form submission event handler. Requires no external services and is invisible to users.
Delivery Time
reCAPTCHA setup for standard components — 1–2 hours. With custom forms and honeypot — 3–4 hours.







