Online forms are targeted by bots, leading to email inboxes of website owners being filled with spam submissions. These submissions typically consist of advertisements but can also contain malicious links that pose security risks. That’s why implementing a verification system would be beneficial if it were effective at preventing these spam submissions.
Bots can easily be trained to crawl the internet and submit advertising or other messages to submission forms on websites. Google offers a free service called reCAPTCHA that performs advanced risk analysis techniques to distinguish between humans and bots. There are multiple versions of reCAPTCHA that have been developed by Google:
v2 Checkbox reCAPTCHA: Prompts users to check a box to prove they’re human.
v2 Invisible reCAPTCHA: Uses advanced technology to detect real users without requiring any input.
v3 reCAPTCHA: Uses a behind-the-scenes scoring system to detect abusive traffic, and lets you decide the minimum passing score. Recommended for advanced use only (or if using Google AMP).
I believe that introducing a verification process, such as reCAPTCHA, should significantly reduce or even eliminate spam submissions. To test my hypothesis, a form was posted on a website, and spam submissions were monitored over time. Initially, the form setup using the WPForms plugin had no verification method. Then, after enough time was given to establish a baseline of activity, I installed reCAPTCHA 3 at a Score Threshold of 0.4. The Score Threshold is used to determine the difficulty level used to prove the user is human. The Score Threshold was then gradually increased over time.
Here are the numbers of spam submissions before and after implementing reCAPTCHA v3:
Period of Time Number of Spam Submissions
May 10 – Jun 10 (no reCAPTCHA used) 6
Jun 10 – Jul 10 (no reCAPTCHA used) 6
Aug 10 – Sep 10 (no reCAPTCHA used) 8
Sep 10 – Oct 10 (no reCAPTCHA used) 5
Oct 10 – Nov 10 (no reCAPTCHA used) 14
Nov 10 – Dec 10 (reCAPTCHA 3 Score 0.4) 30
Dec 10 – Jan 10 (reCAPTCHA 3 Score 0.8) 50
Jan 10 – Feb 10 (reCAPTCHA 3 Score 1.0) 48
One might inquire about the website’s overall traffic during this time? Even if the percentage of spam went down with the reCAPTCHA v3 installed, the total number of spam submissions could still have increased if the site’s overall traffic also grew proportionally during that time. However if you look at the graph in the feature image, it shows that the traffic remained relatively stable throughout this period. The only notable spike occurs in April and May when the site was launched, prior to the overall increase in spam during Nov, Dec and Jan.
Conclusion: The implementation of reCAPTCHA 3 did not eliminate spam submissions from bot activity as expected. Interestingly, it was to the contrary. The higher the ‘Score Threshold’ was set within reCAPTCHA v3, the more spam submissions that were received. This observation suggests that reCAPTCHA 3 is not effective in avoiding or reducing the number of spam form submissions received. Other forms of deterrence’s against spam should be sought out and tested.
