reCAPTCHA: Easy on Humans, Hard on Bots 

Extension Key

recaptcha

Package name

evoweb/recaptcha

Version

13.1

Language

en

Description

Extension to provide reCAPTCHA and invisible reCAPTCHA to form related actions.

Copyright

2015-2024

Author

Sebastian Fischer

License

This document is published under the Open Publication. license.

Rendered

Thu, 29 Jan 2026 20:28:14 +0000


The content of this document is related to TYPO3, a GNU/GPL CMS/Framework available from http://typo3.org


Table of Contents:

Introduction 

This Documentation was written for version 8.2.0 of the extension.

Functionality 

Only purpose is to render the reCAPTCHA and validate the response. But provide these to other extensions which consumes the service.

Also there are limited integrations into other extensions implemented. These act more as an living example and integrate only in extensions used by the author self.

Show example of captcha output

Features 

As a very focused extension only the following features are integrated

  • service for display and validation
  • integration in form rendering of EXT:form
  • integration of invisible captcha in EXT:form
  • viewHelper for display in fluid templates
  • validator for usage in extbase domain model validation
  • adapter for in-/visible captcha in sf_register
  • adapter for in-/visible captcha in typoscript

Users manual 

Usage in ext:form manager 

This extension doesn't come with a content element of any sort. As it is only a service the captcha can't be used on its own. But there is one part where editors are able to have the possibility to configure captcha related settings.

Add captcha to form 

In the form manager it's possible to add the captcha to a form by choosing it in the new field wizard.

Recaptcha on the form element wizard

Configure label 

After the selection the user is able to choose if the label should be rendered in frontend and if so what label text should be used.

Add recaptcha element in form

Use invisible captcha 

To use the invisible reCAPTCHA it's necessary to add an captcha field. Once this is done the form needs to be configured via the settings button on top of the form editor. There the checkbox for "Use invisible recaptcha" needs to be checked.

Configuration of invisible recaptcha

Usage in ext:formhandler 

The invisible mode is only supported at the moment.

Marker for the hidden field:

###recaptcha_invisible###
Copied!

Marker for the submit button:

###recaptcha_button_invisible###
Copied!

Administration 

Installation for both TYPO3 CMS installation types (manual/composer) are supported. For both a compatible installation is provided.

Manual installations 

Download the extension recaptcha either with the browser from typo3.org_ or github and upload it into the installation in the admin tools extensions, or directly in the admin tools extensions with the integrated search.

Composer installations 

On the console in the folder where the project composer.json resides just type:

Installation via composer
composer require evoweb/recaptcha ^8.2
composer update
Copied!

Activation 

After the extension is installed by either way you always need to activate it. Normally this is done in the admin tools extensions. But its also possible to activate it via console:

Activate extension on shell
$ ./bin/typo3 extensionmanager:extension:install recaptcha
Copied!

Configuration 

If, the captcha should be usable in backend context or you like to have a default configuration without touching TypoScript, the extensions need to be configured in the admin tools extensions. Via the cog as shown on the screenshot.

Configure extension settings

Breaking Changes 

13. August 2023 

Partials 

Frontend partials have be changed. If modified check if your partials on changed made to hidden fields.

Configuration removed 

TypoScript setup
  • invisibleCallback
  • captchaCssClass
TypoScript constants
  • invisible_recaptcha_formname
  • include_invisible_recaptcha_callback

Remove support for EXT:formhandler

Configuration 

Reference 

Following parameter are available as constants. And with the same name also as setup parameter.

plugin.tx_recaptcha:

Property
api_server
Data type
string
Default
https://www.google.com/recaptcha/api.js
Description
This url is used to include the basic frontend functionality. In general it's not necessary to modify this url. In case that the api changes and the extension is not updated quick enough changing this parameter keeps the frontend working.
Property
verify_server
Data type
string
Default
https://www.google.com/recaptcha/api/siteverify
Description
Every verification uses this url to check if the captcha was solved. In general it's not necessary to modify this url. In case that the api changes and the extension is not updated quick enough changing this parameter keeps the validation working.
Property
public_key
Data type
string
Default
6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI
Description

The public key is needed for the frontend rendering.

Google provides a key for automatic testing purpose and this is used as default. To remove the warning that is caused by using the default key please go to the recaptcha admin and register an own key for use in your site.

Property
private_key
Data type
string
Default
6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe
Description

The public key is needed for the validation of submits.

Google provides a key for automatic testing purpose and this is used as default. To remove the warning that is caused by using the default key please go to the recaptcha admin and register an own key for use in your site.

Property
lang
Data type
string
Default
empty
Description
Recaptcha is very good in automatic detecting which language to use based on the users browser settings and with which IP the page get's visited. Only in case if it is really necessary set this parameter to take influence on the rendered language.
Property
enforceCaptcha
Data type
bool
Default
0
Description
This configuration parameter will enforce the captcha to test the functionality on development systems. EXT:recaptcha uses the application context to detect if an installation is running in Development mode. If so the captcha is not rendered or validated. This is a to reduce external calls and b to not bother the integrator every time he has to test forms. Because after a limited amount of tests the captcha testing games must always be solved instead only clicking a checkbox.
Property
invisibleCallback
Data type
string
Default
onRecaptchaSubmit
Description
[Only TypoScript] For invisible reCAPTCHA its necessary to have a callback function in JavaScript. It is possible to have own code that derives from the included. If in this case the name of the callback is changed please adjust this parameter to match the new name.
Property
theme
Data type
string
Default
light
Description
[Only TypoScript] For change the theme for recaptcha (light or dark).
Property
robotMode
Data type
bool
Default
0
Description
[Only TypoScript] Add the possibility to set the recaptcha into robot mode in production environment. The recaptcha will not be displayed like in development mode.

Content Security Policy 

Reason 

Since TYPO3 12 handling of content security policies are introduced. If this feature is active, the recaptcha javascript can not be loaded without additional configuration.

CSP Configuration 

To get the recaptcha working with csp feature active, it's necessary to add an extending mutation to the site configuration in a csp.yaml named file.

project_root/config/sites/main/csp.yaml
inheritDefault: true
mutations:
  - mode: extend
    directive: 'frame-src'
    sources:
      - 'https://www.google.com/recaptcha/'
      - 'https://recaptcha.google.com/recaptcha/'

  - mode: extend
    directive: 'script-src'
    sources:
      - 'https://www.google.com/recaptcha/'
      - 'https://www.gstatic.com/recaptcha/'
Copied!

Template modifications 

In previous releases some onclick javascript was used. While the CSP rules are in place, this should be omitted. Some code was moved to the Frontend/form.js. Other was replaced with hidden inputs.

If you override the Frontend/Partials/Form/Navigation.html please check if it's in line with the provided file.

Integration 

Use in your extension 

To make use of this extension is quite easy as there is only one service needed. By instantiating the EvowebRecaptchaServicesCaptchaService it's possible to render and validate the captcha. Beside the service there are a ViewHelper and a Validator for use in extbase extensions.

Integration in your own code 

Rendering hole captcha 

To render you are able to let the service take care of the output by calling getReCaptcha.

Get rendered captcha from service
$captchaService = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance(\Evoweb\Recaptcha\Services\CaptchaService::class);
$output = $captchaService->getReCaptcha();
Copied!

Please keep in mind that it only renders the captcha. If you need something to trigger the validation in your controller it's up to you to add the code.

Render on your own 

If you prefer to render on your own its possible to let the service prepare the settings for you.

Get settings to render individually
$captchaService = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance(\Evoweb\Recaptcha\Services\CaptchaService::class);
$configuration = $captchaService->getConfiguration();
$showCaptcha = $captchaService->getShowCaptcha();
Copied!

By using this you need to render the html completely on your own.

Validate submitted form 

To validate just call the validateReCaptcha method and you get the result of the validation to check against.

Validate captcha in extension
$validCaptcha = false;

$captchaService = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance(\Evoweb\Recaptcha\Services\CaptchaService::class);
$captchaServiceValidation = $captchaService->validateReCaptcha();
if (isset($captchaServiceValidation['verified'])) {
	if ($captchaServiceValidation['verified'] === true) {
		$validCaptcha = true;
	}
}
Copied!

Integration in extbase extension 

Rendering the captcha 

For rendering the captcha in a fluid template there is a ViewHelper that prepares the configuration and then renders the captcha.

ViewHelper example integration
<r:form.recaptcha>
   <f:if condition="{showCaptcha}">
      <f:then>
         <f:form.hidden property="{name}" value="1" />
         <div class="g-recaptcha" data-sitekey="{configuration.public_key}"></div>
      </f:then>
      <f:else>
         <div class="recaptcha-development-mode">
            Development mode active. Do not expect the captcha to appear.
         </div>
      </f:else>
   </f:if>
</r:form.recaptcha>
Copied!

Validation in model 

After the form was submitted the validation of the form model is quite easy. Just annotate as usual.

Add captcha validator to model property
/**
 * virtual not stored in database
 *
 * @var string
 * @validate \Evoweb\Recaptcha\Validation\RecaptchaValidator
 */
protected $captcha;
Copied!

Templating 

For templating there are only two interesting parts to consider. How to use the ViewHelper and direct inclusion in custom extension are the only parts to modify.

ViewHelper integration 

Using the ViewHelper has the benefit that it covers the hole configuration discovery with fallback. Inside the ViewHelper three variables are set.

Property
name
Data type
string
Default
formName[formObject][captcha]
Description
This value depends heavily on fluids field name generation and will vary through out the templates where it gets used.
Property
showCaptcha
Data type
bool
Default
true on Development and false on Production
Description
Contains whether the catpcha should be rendered at all and depends on the application mode.
Property
configuration
Data type
array
Default
settings from TypoScript
Description
Provides the configuration set in TypoScript with fallback to extension configuration set in admin tools extensions.
ViewHelper example integration
<r:form.recaptcha>
   <f:if condition="{showCaptcha}">
      <f:then>
         <f:form.hidden property="{name}" value="1" />
         <div class="g-recaptcha" data-sitekey="{configuration.public_key}"></div>
      </f:then>
      <f:else>
         <div class="recaptcha-development-mode">
            Development mode active. Do not expect the captcha to appear.
         </div>
      </f:else>
   </f:if>
</r:form.recaptcha>
Copied!

Integration in extension 

Here the extension delivers only limited settings. In TypoScript there is the public_key defined which can be rendered as stdWrap to resolve an div container with all needed information to output the captcha.

Tutorial 

Use invisible recaptcha in EXT:form forms 

To use the invisible captcha in the form you need to add the advanced element "reCAPTCHA". This field has the validation automatically added. Next step is to open the "Settings" of the form and need to check the "Use invisible recaptcha".

At last you need to add the TypoScript constants. One is to enable to the inclusion of the invisible recaptcha callback and the other is to tell the callback which id the form to handle has.

plugin.tx\_recaptcha {
    include\_invisible\_recaptcha\_callback = 1
    invisible\_recaptcha\_formname = captchaForm-4
}
Copied!

Sitemap