--- title: "Securing and protecting forms" date: "2026-07-13T14:46:09+00:00" summary: "Protect Drupal Canvas Forms with CAPTCHA, honeypot traps, and rate limiting. Learn to configure providers and enforce spam controls." image: type: "page" url: "/source-cms/securing-and-protecting-forms" id: "d2bc98c8-786f-4cbf-9b8c-ad131d7b45d9" --- Drupal Canvas Forms verifies that submissions originate from a human through a CAPTCHA challenge on the forms. CAPTCHA provides a provider-agnostic, site-wide layer. An administrator configures one provider and one enforcement mode, and the setting applies to every Drupal Canvas form. The server verifies the CAPTCHA response of each submission before it accepts the data. CAPTCHA runs in addition to the built-in spam controls, and it runs after them because the CAPTCHA verification requires a network call to the provider. Prerequisites ------------- * Ensure that an administrator account has the **Administer CAPTCHA** permission. For more information, visit [Managing permissions](/source-cms/managing-permissions "Managing permissions") Automated anti-spam protections ------------------------------- Drupal Canvas Forms enforces the following protections for unauthenticated endpoints: Protection Description **Honeypot traps** A hidden honeypot field must remain empty. If the system detects a filled honeypot, it stores the submission as a suspect record and returns a response that appears successful to prevent bots from detection. The system does not send webhooks for suspect submissions. **Signed challenge tokens** The system requires a single-use, signed challenge token before each submission and file upload. This token proves that the request originated from a real browser and prevents replay attacks. **Rate limiting** Drupal Canvas Forms enforces per-Internet Protocol (IP) address limits and site-wide limits within a time window. By default, this limit is 10 submissions per IP address every 10 minutes, with a higher global ceiling. Rejected spam counts toward these limits. File uploads and token requests maintain separate limits. Supported Providers ------------------- CAPTCHA supports the following providers: Provider Notes **Cloudflare Turnstile** Privacy-friendly challenge with no visible puzzle in most cases. **hCAPTCHA** Widget-based challenge. **Friendly CAPTCHA** Proof-of-work challenge with no user interaction. **Google reCAPTCHA v3** Invisible, score-based verification. Important You must obtain a site key and a secret key from the chosen provider before the start of the configuration.   Enforcement modes ----------------- CAPTCHA features two modes to verify form setups before the system blocks submissions: * **Monitor**: In this report-only mode, Drupal Canvas Forms verifies each submission and logs the result but blocks nothing. Administrators use this mode to confirm that every form includes the CAPTCHA widget and emits valid tokens. * **Enforce**: Drupal Canvas Forms rejects any submission that fails verification, which includes submissions from a form that lacks the CAPTCHA widget. In the generated form component, a rejected submission displays a failure message and asks the visitor to try again. CAPTCHA never locks out real users because of a configuration problem or a provider problem. If an administrator disables CAPTCHA, misconfigures CAPTCHA, or the provider becomes unreachable, Drupal Canvas Forms does not block submissions based on the CAPTCHA signal. The honeypot, rate limit, and challenge token controls continue to apply. Only a definitive verification failure, or an absent token in the Enforce mode, rejects a submission. Configure CAPTCHA ----------------- To configure CAPTCHA: 1. Sign in to the provider and create a site 2. Copy the public **site key** and the private **secret key**. 3. [Access your site](https://docs.acquia.com/node/69836#access-a-site). 4. In the Source CMS administration menu, click **Configuration**. 5. Click **System** and select **CAPTCHA**. 6. Toggle **Enable CAPTCHA protection**. 7. Choose **Monitor for the Mode to start**.  Note Switch to **Enforce** only after the confirmation that the forms function correctly. For more information refer to [Test and enforce CAPTCHA](). 8. Select the configured provider for the **Provider** setting. 9. Enter the key in the Site key field. This value is public and appears on the page. 10. Enter the key in the Secret key field. 11. Select Save configuration. Drupal Canvas Forms stores the secret key securely on the server and never displays it again. To replace the secret key, enter a new value and save the configuration. To remove the secret key, select Remove the stored secret. An administrator cannot remove the secret key while CAPTCHA remains enabled. Enter a replacement key first or disable CAPTCHA. Add the widget to a form ------------------------ While CAPTCHA remains enabled, the starter code generated on the **Connect** view includes the CAPTCHA widget. Forms generated or regenerated work with CAPTCHA automatically. To add the widget to a hand-authored form component, add two lines of code: 1. Add the import at the top of the component with the other imports: import { CanvasFormCaptcha } from 'acquia/captcha'; 2. Add the widget inside the form before the submit button: The widget locates its own enclosing form and requires no properties. The CAPTCHA settings page displays these two snippets for easy duplication. Test and enforce Captcha ------------------------ Turn CAPTCHA on in the **Monitor mode** first. In this mode, Canvas Forms logs a message for any submission that the system would otherwise reject, which includes submissions to forms that lack the widget. This helps administrators find and fix errors without turning away real visitors. After the logs confirm that all forms submit valid CAPTCHA tokens, change the **Mode** to **Enforce** and **Save**.