Marketo Engage Form CAPTCHA integration

Marketo Employee
Marketo Employee

With our August 2022 release we are introducing a CAPTCHA integration on Marketo Engage forms using Google reCAPTCHA v3. This feature will be enabled for all customers on the evening of September 20th, 2022 (US time). 


A previous version of this post mentioned feature enablement would occur on September 6th. In order to deploy some additional infrastructure enhancements to increase form performance, we are having to delay enablement until September 20th. Thank you for your patience.


So, what exactly is CAPTCHA and how can it help marketers? CAPTCHA is an acronym that stands for Completely Automated Public Turing Test to tell Computers and Humans Apart. It is a type of test used by websites and services to determine whether the interacting user is a human or a bot. There are multiple CAPTCHA types such as image, audio, mathematical, or word challenges and multiple CAPTCHA vendors.


If you have forms on the web, it is likely you have been targeted by bots at least once. This could include spikes in rapid form submissions from a single IP address, submissions made in languages or from regions your business does not market to, or values submitted that do not make sense contextually to what your form was asking for.


Marketo Engage has chosen to use a score-based CAPTCHA implementation using Google reCAPTCHA v3 to tackle this problem. This type of implementation does not challenge your leads with images, words, or mathematical equations in order to minimize friction interacting with your form. Instead, the likelihood of the submission being from a bot is calculated by the CAPTCHA vendor and this information is included in the submission’s metadata. This allows you to flag, quarantine, delete, or ignore submissions using Smart List and Smart Campaigns based on their scores.


Using CAPTCHA for lead segmenting


Filled Out Form activities will have new attributes:


CAPTCHA Provider

This field captures the CAPTCHA provider configured for the subscription. Marketo Engage currently only integrates with Google reCAPTCHA so the value will always be “reCAPTCHA”.



This field captures the raw score returned by the CAPTCHA provider. It will always be a value between 0.0 and 1.0. For reCAPTCHA v3, scores closer to 1.0 are likely human and scores closer to 0.0 are likely bots.


CAPTCHA Normalized Score

This is a normalized version of the score returned by the CAPTCHA provider as interpreted by Marketo Engage. This also includes normalized error messages returned by the provider or that occurred during processing. The values can be:


  • TRUSTED: Score of the submission >= 0.5. The submission is likely from a human.
  • SUSPICIOUS: Score of the submission < 0.5. The submission is likely from a bot.
  • MISSING: The CAPTCHA provider did not return a score for the submission.
  • QUOTA: The monthly quota of evaluations set by the CAPTCHA provider has been reached. Contact the CAPTCHA provider to purchase more evaluations.
  • FAILED: An error occurred during processing.

These attributes are visible in the Activity Details when digging into the Filled Out Form activity. They can also be used in the Filled Out Form filter and the Fills Out Form trigger.


Ideas how to use score-based CAPTCHA for marketing:

  • Excluding low scoring submissions from campaigns that trigger on Form Fills such as scoring campaigns, campaigns that send emails (such as Contact Us or Sign Up), and campaigns that sync new records into the CRM
  • Create Smart Lists that pull records with recent suspicious form submissions. Use these Smart Lists to exclude records from Smart Campaigns or simply for periodic review
  • Build trigger campaigns to automatically Marketing Suspend or Blocklist records with low scoring form submissions (but do not forget to have a process to review and revert if needed!)

Questions & Answers


Is CAPTCHA applied to all Forms when enabled?


CAPTCHA must be enabled on a per form basis. This enables you to control the volume being submitted to your CAPTCHA provider as to not overwhelm purchased volumes. Once enabled on a form, the setting will be carried over whenever you cloned the enabled form.


Will other CAPTCHA providers or implementations be added in the future?


We will consider additional providers in our future roadmap based on user feedback, but none are planned at this time.


Why did Marketo Engage decided on a score-based solution such as reCAPTCHA v3? Why cannot I set up an image challenge?


Our teams performed market and user research when deciding on which type of CAPTCHA implementation to create for Marketo Engage. Our research told us that marketing administrators were hesitant to implement any solution that added additional friction to filling out the form such as image challenges or puzzles. Additionally, our partners at Google recommend the practice of “shadow banning” suspicious submissions by excluding them from audiences within the Marketo Engage subscription rather than blocking them on the front end. By scoring form submissions and building workflows to determine how the person should be processed you can ensure that you are not creating a high barrier for conversion or blocking false positives.


We are considering ways to enhance the CAPTCHA solution to give you more control over incoming submissions as they are being submitted to react to suspicious scores.


How many form submissions can the reCAPTCHA implementation handle per month?


This limit is set by Google. Free reCAPTCHA v3 keys can handle up to 1,000,000 submissions per month at no charge and our form traffic data shows this is sufficient for most customers. If your business requires more than 1,000,000 calls a month you can convert your key to reCAPTCHA Enterprise which offers additional volumes of submissions.


Why doesn’t CAPTCHA assign a score to a Person record? Why is it only stored on the Filled Out Form activity?


CAPTCHA measures the likelihood of a specific browser session interacting with your forms of being a bot. This score could change across different sessions or different devices. Since it is not a static value and is attributed to a single Form submission, it does not make sense to make the CAPTCHA score a static value stored as a lead field.


Do you intend on enhancing the CAPTCHA functionality? What is next on the roadmap?


This is only the beginning of our CAPTCHA implementation. We are evaluating additional enhancements on the roadmap such as:

  • The ability to define the “action” parameter that is logged in reCAPTCHA with the submission.
  • The ability to block or discard submissions that fail to meet certain score thresholds
  • Expanded controls on enabling or disabling CAPTCHA on forms
  • Additional language support
  • Customization of the reCAPTCHA legal disclaimer


We will of course be listening to your feedback for future roadmap ideas too!

Level 4

Hi @Steven_Vanderb3  - Is there a quota with this feature? One of the normalized score values is:

  • QUOTA: The monthly quota of evaluations set by the CAPTCHA provider has been reached. Contact the CAPTCHA provider to purchase more evaluations.

Level 10


"Free up to 1 million Assessments / Month*" - but this is across all domains you track with that Google account. Did you set up the account yourself and retrieved the key pair? Is it possible that you have reached that many calls?

Level 4

Hi @Michael_Florin - Yes, I set up the account myself and retrieved the key pair - for 2 Marketo instances (I'm a consultant) - and made my clients co-owners. No, it's not possible that I reached that many calls. I just wanted to know. Sounds like I should re-do the setup from the clients' Google Accounts so as not to limit their quota.

Marketo Employee

@DeniseGreenberg we should only be writing that error if Google is telling us the quota has been exceeded: keyword should. If you think you shouldn't have hit your million calls (and it should be pretty clear from your Google dashboard) then submit a Support ticket to look into. Maybe the incorrect error handler is being called on our side.

Level 4

@Steven_Vanderb3 - I'm not getting an error. I was just asking what the quota was given that one of the possible values for the Normalized Score included "Quota exceeded, etc."


Something that isn't super clear in the instructions though - I set up the integration for two of my clients so far using my own Google account. I didn't think about the account. I just followed the instructions and went to the Google site and set it up - and I made employees at my client companies co-owners. But if the Quota is tied to my Google account, as Michael Florin seemed to indicate, it seems that it's important to do the Google part of the setup under an account owned by the company that owns the Marketo instance. Do you agree?

Level 1

Hi all, just attempting to enabled CAPTCHA integration on hidden form. I saw save2 with success code 200 but no record created in Marketo. Any idea whether it's supported for hidden form? Thanks

Level 1

Hi experts,

I am trying to implement reCAPTCHA in our instance but getting a few questions from data privacy team on this


1. What personal data is being captured? Is it all obtained by Google?

2. Are IP addresses captured in full or are they truncated?

3. What type of cookies are used by reCAPTCHA?