CAPTCHA - Modern Spam Protection for Your Webforms (CRM)

The CAPTCHA on your webform embed code has been upgraded to a modern, invisible version. The previous CAPTCHA service was retired by Google in 2018, which meant your forms were silently accepting spam even though they appeared to be protected. With this update, visitors no longer need to type anything to prove they are human — the new CAPTCHA verifies them automatically in the background using behavioral signals.

To benefit from this protection, two things must happen: a Dazos administrator must register the website domain(s) with Google reCAPTCHA (a one-time setup per domain) and paste the reCAPTCHA keys into the new Configure CAPTCHA screen inside the CRM. After that, each website owner must replace their existing webform embed code with a freshly copied version from the CRM.

Important: Until the domain is authorized in Google reCAPTCHA and the new embed code is pasted onto the website, submissions on the affected domain will be silently rejected or will accept spam. Complete the steps end-to-end before declaring the upgrade done.

You will need:

Access requirements: Sections 2 and 3 of this guide are for Dazos administrators (or whoever manages the Google reCAPTCHA account on behalf of Dazos). Sections 4 through 8 are for the website owner — typically a customer admin or a marketing team member. If you are a customer following this guide, skip to section 4.

This step is a one-time setup per Google reCAPTCHA site. Once a site is registered, every new customer domain can be added to the existing Domains list — no need to create a new site key for each customer.

1. Click the + (plus) icon in the top-right of the admin console to add a new site.

2. Fill out the Register a new site form:

3. Click Submit.

When a new customer signs up and wants to embed a webform on their site:

1. Open the reCAPTCHA admin console.

2. Open the existing Dazos site (e.g. Dazos Webforms v3).

3. Click the gear icon in the top-right corner of the site card, then choose Settings. 4. Expand the Domains section.

5. In the empty entry row, type the customer’s domain. Use the bare domain only — no http://, no https://, no trailing slash, no path.

6. Press Enter or click Add.

7. Repeat for every additional domain (test, staging, production).

8. Click Save at the bottom of the panel.

Tip: Allow about 60 seconds for the domain change to propagate before testing. If you submit a form too soon after saving, you may still see “Invalid domain for site key” until propagation completes.

Example domain entries:

Important: Whenever a customer mentions their form is on a new subdomain (for example, moving from www.clinic.com to forms.clinic.com), repeat step 2.3 for the new subdomain. The CAPTCHA will silently fail on any domain not in this list.

Each reCAPTCHA v3 site in the Google admin console has two keys:

The CRM now provides a dedicated Configure CAPTCHA screen so administrators no longer need to edit any configuration files directly.

1. In the reCAPTCHA admin console, open the Dazos site.

2. Click the gear icon, then Settings.

3. Expand the reCAPTCHA keys section.

4. Reveal and copy the SITE KEY to a secure note.

5. Reveal and copy the SECRET KEY to a secure note.

1. Log in to the CRM with an administrator account.

2. From the top navigation, click Integrations.

3. From the Integrations menu, select Webforms.

4. On the Webforms list page, click the Configure CAPTCHA button (shield icon, top-right of the list).

The Configure CAPTCHA modal opens. It contains the following fields:

1. In the Site Key field, paste the value you copied from Google.

2. The site key is public — it is shown in plain text and is safe to share.

The Secret Key field behaves differently depending on whether a secret has previously been saved. This was updated in the latest release to prevent administrators from accidentally overwriting or echoing the live secret.

First-time setup (no secret saved yet):

Updating an existing secret (a secret is already saved):

You have two choices:

Tip: Click the eye icon at the right of the field to reveal what you have typed (only while typing — the saved secret is never revealed).

reCAPTCHA v3 returns a score from 0.0 (very likely a bot) to 1.0 (very likely a human) for every submission. The CRM rejects any submission scoring below the configured threshold.

1. Click Advanced inside the modal to expand the threshold control.

2. Enter a value between 0.0 and 1.0 in steps of 0.1. Default is 0.5.

Tip: Start at 0.5. If real customers report rejected submissions, lower to 0.3. If spam is still getting through, raise to 0.7. Adjust one form at a time and monitor for a week between changes.

1. Click Save Configuration.

2. A confirmation message appears and the Last updated line in the modal footer is refreshed with your name and the current timestamp.

3. The Secret Key field is cleared again, and the placeholder updates to show the new masked tail — confirming the new secret is saved.

No service restart is required. The new keys take effect on the next form submission.

1. Log in to the CRM with your normal credentials.

2. From the top navigation menu, click Integrations.

3. In the Integrations menu, select Webforms.

You will see a list of every webform configured for your instance. Each row represents one form that can be embedded on a website.

For the spam protection to be applied, the Captcha Enabled option on the webform must be turned on.

1. From the Webforms list, click the webform you want to update.

2. Click Edit.

3. Locate the Captcha Enabled field on the form.

4. Make sure it is checked. If it is already checked, no change is needed.

5. Click Save.

Tip: If your form was previously protected (or supposed to be protected), Captcha Enabled is almost certainly already on. There is no need to disable and re-enable it — just confirm.

1. Return to the Webforms list, or stay on the webform’s detail page.

2. Open the Show Form view for the webform (this is the same option you used when you first set up the embed).

3. A preview of the form will appear with a copy icon next to it.

4. Click the copy icon. The full embed code, including the new CAPTCHA, is now on your clipboard.

Tip: If you have multiple webforms on your website, repeat steps 6.1 through 6.4 for each one. Each form has its own embed code.

1. Open the page on your website where the form is currently embedded.

2. Find the existing embed code (it begins with <form id="__vtigerWebForm" and ends with </script>).

3. Delete the entire existing embed code. Do not try to merge the new code with the old one — replace it entirely.

4. Paste the new embed code from your clipboard in the same location. 5. Save and publish the page.

Important: The new embed code keeps your existing form fields, layout, and submission destination unchanged. Anything you customized around the form on your website (heading text, styling, surrounding content) is unaffected. Only the embed code itself needs to be replaced.

After publishing, visit the page on your live website and confirm the form is working with the new protection.

1. Open the published page in any browser.

2. Look at the bottom-right corner of the page. You should see a small reCAPTCHA badge that says “protected by reCAPTCHA”.

3. Fill in every required field with realistic information.

4. Submit the form.

5. Log in to the CRM and confirm a new record was created with the data you submitted.

Tip: The reCAPTCHA badge is a small floating panel near the bottom-right corner. Some ad blockers may hide it; if you do not see it but submissions arrive in the CRM successfully, the protection is still working.

You may notice a few changes once the update is in place: