Marketo Engage Form CAPTCHA integration

Steven_Vanderb3
Marketo Employee
Marketo Employee

With our August 2022 release we are introducing a CAPTCHA integration on Marketo Engage forms using Google reCAPTCHA v3. This feature will be enabled for all customers on the evening of September 20th, 2022 (US time). 

 

A previous version of this post mentioned feature enablement would occur on September 6th. In order to deploy some additional infrastructure enhancements to increase form performance, we are having to delay enablement until September 20th. Thank you for your patience.

 

So, what exactly is CAPTCHA and how can it help marketers? CAPTCHA is an acronym that stands for Completely Automated Public Turing Test to tell Computers and Humans Apart. It is a type of test used by websites and services to determine whether the interacting user is a human or a bot. There are multiple CAPTCHA types such as image, audio, mathematical, or word challenges and multiple CAPTCHA vendors.

 

If you have forms on the web, it is likely you have been targeted by bots at least once. This could include spikes in rapid form submissions from a single IP address, submissions made in languages or from regions your business does not market to, or values submitted that do not make sense contextually to what your form was asking for.

 

Marketo Engage has chosen to use a score-based CAPTCHA implementation using Google reCAPTCHA v3 to tackle this problem. This type of implementation does not challenge your leads with images, words, or mathematical equations in order to minimize friction interacting with your form. Instead, the likelihood of the submission being from a bot is calculated by the CAPTCHA vendor and this information is included in the submission’s metadata. This allows you to flag, quarantine, delete, or ignore submissions using Smart List and Smart Campaigns based on their scores.

 

Using CAPTCHA for lead segmenting

 

Filled Out Form activities will have new attributes:

 

CAPTCHA Provider

This field captures the CAPTCHA provider configured for the subscription. Marketo Engage currently only integrates with Google reCAPTCHA so the value will always be “reCAPTCHA”.

 

CAPTCHA Raw Score

This field captures the raw score returned by the CAPTCHA provider. It will always be a value between 0.0 and 1.0. For reCAPTCHA v3, scores closer to 1.0 are likely human and scores closer to 0.0 are likely bots.

 

CAPTCHA Normalized Score

This is a normalized version of the score returned by the CAPTCHA provider as interpreted by Marketo Engage. This also includes normalized error messages returned by the provider or that occurred during processing. The values can be:

 

  • TRUSTED: Score of the submission >= 0.5. The submission is likely from a human.
  • SUSPICIOUS: Score of the submission < 0.5. The submission is likely from a bot.
  • MISSING: The CAPTCHA provider did not return a score for the submission.
  • QUOTA: The monthly quota of evaluations set by the CAPTCHA provider has been reached. Contact the CAPTCHA provider to purchase more evaluations.
  • FAILED: An error occurred during processing.

These attributes are visible in the Activity Details when digging into the Filled Out Form activity. They can also be used in the Filled Out Form filter and the Fills Out Form trigger.

 

Ideas how to use score-based CAPTCHA for marketing:

  • Excluding low scoring submissions from campaigns that trigger on Form Fills such as scoring campaigns, campaigns that send emails (such as Contact Us or Sign Up), and campaigns that sync new records into the CRM
  • Create Smart Lists that pull records with recent suspicious form submissions. Use these Smart Lists to exclude records from Smart Campaigns or simply for periodic review
  • Build trigger campaigns to automatically Marketing Suspend or Blocklist records with low scoring form submissions (but do not forget to have a process to review and revert if needed!)

Questions & Answers

 

Is CAPTCHA applied to all Forms when enabled?

 

CAPTCHA must be enabled on a per form basis. This enables you to control the volume being submitted to your CAPTCHA provider as to not overwhelm purchased volumes. Once enabled on a form, the setting will be carried over whenever you cloned the enabled form.

 

Will other CAPTCHA providers or implementations be added in the future?

 

We will consider additional providers in our future roadmap based on user feedback, but none are planned at this time.

 

Why did Marketo Engage decided on a score-based solution such as reCAPTCHA v3? Why cannot I set up an image challenge?

 

Our teams performed market and user research when deciding on which type of CAPTCHA implementation to create for Marketo Engage. Our research told us that marketing administrators were hesitant to implement any solution that added additional friction to filling out the form such as image challenges or puzzles. Additionally, our partners at Google recommend the practice of “shadow banning” suspicious submissions by excluding them from audiences within the Marketo Engage subscription rather than blocking them on the front end. By scoring form submissions and building workflows to determine how the person should be processed you can ensure that you are not creating a high barrier for conversion or blocking false positives.

 

We are considering ways to enhance the CAPTCHA solution to give you more control over incoming submissions as they are being submitted to react to suspicious scores.

 

How many form submissions can the reCAPTCHA implementation handle per month?

 

This limit is set by Google. Free reCAPTCHA v3 keys can handle up to 1,000,000 submissions per month at no charge and our form traffic data shows this is sufficient for most customers. If your business requires more than 1,000,000 calls a month you can convert your key to reCAPTCHA Enterprise which offers additional volumes of submissions.

 

Why doesn’t CAPTCHA assign a score to a Person record? Why is it only stored on the Filled Out Form activity?

 

CAPTCHA measures the likelihood of a specific browser session interacting with your forms of being a bot. This score could change across different sessions or different devices. Since it is not a static value and is attributed to a single Form submission, it does not make sense to make the CAPTCHA score a static value stored as a lead field.

 

Do you intend on enhancing the CAPTCHA functionality? What is next on the roadmap?

 

This is only the beginning of our CAPTCHA implementation. We are evaluating additional enhancements on the roadmap such as:

  • The ability to define the “action” parameter that is logged in reCAPTCHA with the submission.
  • The ability to block or discard submissions that fail to meet certain score thresholds
  • Expanded controls on enabling or disabling CAPTCHA on forms
  • Additional language support
  • Customization of the reCAPTCHA legal disclaimer

 

We will of course be listening to your feedback for future roadmap ideas too!

12185
27
27 Comments
anne_sample_f5
Level 4

@SanfordWhiteman got it, thanks! I assumed the hidden-ness was a problem because the form was throwing an error, but that's obviously not the case as I tried submitting the form again a couple hours later and it seems to have worked fine.

amarbhide
Level 1

Do we know whether Marketo is going to support the new Captcha version which is click-less?

SanfordWhiteman
Level 10 - Community Moderator

Do we know whether Marketo is going to support the new Captcha version which is click-less?

@amarbhide please read the question + response above yours.

Michael_Florin
Level 10

@Steven_Vanderb3 wrote:

 

Why did Marketo Engage decided on a score-based solution such as reCAPTCHA v3? Why cannot I set up an image challenge?

 

Our teams performed market and user research when deciding on which type of CAPTCHA implementation to create for Marketo Engage. Our research told us that marketing administrators were hesitant to implement any solution that added additional friction to filling out the form such as image challenges or puzzles. Additionally, our partners at Google recommend the practice of “shadow banning” suspicious submissions by excluding them from audiences within the Marketo Engage subscription rather than blocking them on the front end. By scoring form submissions and building workflows to determine how the person should be processed you can ensure that you are not creating a high barrier for conversion or blocking false positives.

 Or read the blog post you're commenting on. 🙂


FYI @all - I filed a support ticket exactly three days ago. Haven't heard back yet.

mwlittle
Level 1

@SanD With Marketo having this in their release and providing "instructions" to enable in Marketo do you recommend still using your step-by-step webinar to run it correctly? Want to make sure no "gotchas" happen.

 

Or is an updated webinar in the works? 🙂

https://iluv.marketingops.com/integration-for-marketo-and-google-recaptcha-v3

SanfordWhiteman
Level 10 - Community Moderator

With Marketo having this in their release and providing "instructions" to enable in Marketo do you recommend still using your step-by-step webinar to run it correctly? Want to make sure no "gotchas" happen.

You wouldn’t use my guide anymore (sadly!) as it operates on a different level.

Michael_Florin
Level 10

Here's what Marketo Support came back with:

 

So the CAPTCHA on forms should all be working now however, you are right it's not possible at the moment to use it as a constraint on filters or triggers for filling out forms.From reading the blog post and the section on what's next on the roadmap, it appears further functionality will be coming but at the moment I don't have a concrete timeline on that.

 

I'd say this feature is useless without giving us the option to do something with the CAPTCHA score. Also there's now way of knowing whether or not Marketo actually sends something to Google.

Tyron_Pretorius
Level 8 - Champion

@Michael_Florin since I posted I have been able to bring constraints into triggers and filters

 

"Also there's now way of knowing whether or not Marketo actually sends something to Google." Also there are two ways to know if something has been sent to Google from Marketo. You can check your CAPTCHA dashboard to see requests that have come through or the activity detail for the form fill should indicate if an error occurred or if you get a score back you can assume that Marketo sent info to CAPTCHA and CAPTCHA sent information back

 

Tyron_Pretorius_0-1664807604865.png

 

Michael_Florin
Level 10

Thanks Tyron - I'm seeing everything now too.

 

1. Enable CAPTCHA in Admin section. Add Google keys.

2. Enable CAPTCHA on form. (I think here's still some things left to do. The hint text that appears on the form/LP is English only, and I don't see an option to customize it.)
3. On the form submit activity, the score is now included:

Michael_Florin_0-1664886324255.png

Which of course gives us the option to only trigger Smart Campaigns for scores 0.x or higher.

 

DeniseGreenberg
Level 4

Hi @Tyron_Pretorius & @Michael_Florin - I'm seeing everything now, too. However, I'm finding that whenever I create a smart campaign or smart list - when I look for the reCaptcha constraints on the Filled Out Form filter (or Fills Out Form trigger) they are missing until I refresh the browser page. I'll report this to Support.