Form Protection in 1С-Битрикс: Configuring reCAPTCHA and Honeypot

Configuring CAPTCHA in 1С-Битрикс: Choosing a Protection Strategy

Spam bots don't sleep. Yesterday — 2000 comments overnight, today — 5000 registrations from suspicious IPs. If a registration or feedback form is not protected, bots find the endpoint and clog the event queue (b_event). The admin drowns in notifications, and the database swells with junk. Overnight, the queue can grow to 10,000 records — the mail server gets blacklisted, and the site loses important leads. In 1С-Битрикс, form protection is not just a checkbox in the admin panel. It's a strategy choice: built-in CAPTCHA, Google reCAPTCHA v2/v3, or Honeypot. Each option is effective in its own scenario, but a wrong choice reduces conversion or lets spam through. Configuring CAPTCHA in Bitrix requires understanding the architecture of infoblocks, HL-blocks, and agent mechanics. We'll break down how to properly connect each method and show a real case from practice.

CAPTCHA Types: Comparing Approaches

Choosing between them is a balance of security and usability. Built-in CAPTCHA requires no external services, but is easily cracked by neural networks. reCAPTCHA v3 evaluates behavior on a scale 0.0–1.0 and doesn't bother users, but won't work without HTTPS. Honeypot — a hidden field that bots fill while humans don't; it doesn't affect conversion but requires proper implementation. We recommend a combination: reCAPTCHA v3 for critical forms (registration, checkout), Honeypot for less important ones (feedback, subscription).

How to Configure reCAPTCHA v3 in Bitrix?

To connect reCAPTCHA v3, follow three steps. First, register your site at google.com/recaptcha. Get a Site Key and Secret Key. Then in the admin panel go to: Settings → Main Module → CAPTCHA. Select reCAPTCHA type and enter the keys. Finally, for standard components set the parameter USE_CAPTCHA = Y. If using a custom component, add verification with \Bitrix\Main\Security\Captcha\CaptchaManager (module main, D7). Note that reCAPTCHA v3 requires HTTPS — keys won't work without it. Detailed instructions can be found on helpdesk.bitrix24.ru. As noted by Wikipedia, v3 allows eliminating clicks, but requires analyzing the trigger threshold (usually 0.5).

Why Honeypot is Better for Conversion?

For high-conversion forms — callback requests, service bookings — even reCAPTCHA in invisible mode can reduce submissions by 10–20%. Honeypot solves this: the field is hidden from the user, but the bot sees and fills it. In Bitrix, implementation is simple: in init.php via the OnBeforeEventAdd event handler, we check if the hidden field is filled. If yes — block the submission. This method requires no external services and is invisible to the user. Setup takes 1–2 hours. Guarantee — zero false positives on real visitors. Savings on moderation — up to 5 hours per week.

What to Do if CAPTCHA Interferes with Users?

If you notice a sharp drop in conversion after enabling CAPTCHA, start with analysis. Check which form has the biggest drop. For that form, it's optimal to use Honeypot or reCAPTCHA v2 (checkbox) — it requires one click but doesn't cause frustration. Another option is to increase the trigger threshold in reCAPTCHA v3 from 0.5 to 0.7, but this reduces protection. In any case, we recommend testing different CAPTCHA types on individual forms using A/B tests. We help set up such a scheme — contact us for a consultation.

How to Connect CAPTCHA to Custom Components?

Standard components have the USE_CAPTCHA parameter:

• bitrix:main.register — USE_CAPTCHA = Y
• bitrix:main.login — USE_CAPTCHA = Y
• bitrix:form — checkbox in form settings "Use CAPTCHA"
• bitrix:sale.basket.basket — CAPTCHA during checkout (if enabled in the module)

For custom forms, use the class \Bitrix\Main\Security\Captcha\CaptchaManager. Pay special attention to AJAX requests: the check must be on the server side, otherwise bots can easily bypass protection. Integrate the check into event handlers and agents to avoid extra load on infoblocks and HL-blocks.

What's Included in CAPTCHA Setup

• Audit of current forms and endpoints, identifying vulnerabilities
• Selection of optimal CAPTCHA type for each form
• Configuration of reCAPTCHA (v2/v3) or built-in CAPTCHA in the admin panel
• Development of custom components with AJAX and REST verification
• Implementation of Honeypot fields for high-conversion forms
• Testing against bots and real scenarios
• Documentation on settings and access
• One month of support after implementation

Case Study: News Portal Without Spam

A news portal came to us with a problem: a comment form without CAPTCHA. Overnight — 500 to 2000 spam messages. Bots found the direct POST request to the endpoint. The mail queue got clogged, the server crashed. Solution: connected reCAPTCHA v2 to the comment component. The component was custom, so we manually added the CCaptcha::IsCaptchaValid() call in the handler. For AJAX requests — an additional verification via REST. Result: spam dropped by 99%. The client was satisfied. The case showed that even simple reCAPTCHA v2 is dozens of times more effective than no protection.

Work Process and Timeline

We perform CAPTCHA setup according to this scheme:

1. Audit of current forms and endpoints (1 day)
2. Selection of optimal CAPTCHA type and approval (up to 2 hours)
3. Configuration of reCAPTCHA or built-in CAPTCHA (1–2 hours)
4. Development of custom components with verification (3–4 hours)
5. Implementation of Honeypot fields (2–3 hours)
6. Testing and documentation (1–2 hours)

The cost is calculated individually. We'll evaluate your project for free — just contact us.

Our Experience and Guarantees

We have been working with Bitrix for over 5 years, holding "1С-Битрикс: Developer" and "Битрикс24: Integrator" certifications. We have completed more than 50 security projects. We provide a guarantee on all work — if spam returns, we fix it for free. Order comprehensive spam protection today and forget about bots forever.