Step by step guide to recaptcha

[Sarah_Bartell1]

I've read through all the discussions and threads on implementing google's recaptcha in a marketo form (we are getting tons of spam and the honeypot thing isn't working).

I have the site key needed from Google, I have the code written by Sanford Whiteman​, and now I have no idea how to start to implement this - I'm pretty sure I can figure out the form part with the css and js but i'm mostly confused by the back-end portion with the webhook.

Does anyone have a step by step guide? We need to get this done on our site asap.

Thanks much!

[Akshay_Pant]

HI Sarah Bartell​,

Please refer to this link :

http://jennamolby.com/how-to-build-a-spam-free-marketo-form-without-using-a-captcha/?source=marketo-...

I think this stuff would really helpful for making spam free recaptcha.

Regards,

Akshay Pant

[SanfordWhiteman]

Except anybody who wants to spam such a form can trivially work around that code. I mean, the rules are right there in the view-source. It's not the same as a ReCAPTCHA... at all.

[Sarah_Bartell1]

As I mentioned above, we tried the honeypot field and it didn't work. We still got hit over 30k times by a spambot. We've opened a ticket with Marketo support to see if anyone can walk us through the ReCaptcha, but if anyone has done this in Marketo before and has a quick step by step guide, or could list out the process for us in the meantime, that would be super helpful!

[SanfordWhiteman]

It's not something I've ever documented end-to-end (too many other blog posts and projects in motion) but the ingredients on the back end (you seem to understand the front end) are:

• Set up 3 fields, LastReCAPTCHAUserResponse (string), LastReCAPTCHAServerStatus (boolean), LastReCAPTCHAServerSuccess (datetime), LastReCAPTCHAServerFailure (datetime)
• LastReCAPTCHAUserResponse is what holds the unique ReCAPTCHA response ID on the form end, the others are used only on the back end
• A webhook calls the Google ReCAPTCHA endpoint and passes {{lead.LastReCAPTCHAUserResponse}}
• The webhook response mapping maps the Google response to LastReCAPTCHAServerStatus
• In a trigger SC, catch a change to LastReCAPTCHAServerStatus and set either LastReCAPTCHAServerSuccess or LastReCAPTCHAServerFailure to {{system.datetime}} based on whether the status is good/bad
• Take other flow actions to sort leads into suspect/deletable lists accordingly. You don't want to delete suspect leads immediately when first rolling out. First quarantine the leads, check 'em out, and then you can start deleting them nightly or immediately.

No one at Support is going to understand this at all, sorry to say. This is pretty much my baby when it comes to Marketo.

[Mark_Brailsford]

Sanford this approach makes sense to me. Would it work in an embedded form? Also, where's a good place to learn about implementing the webhook that calls the Google ReCAPTCHA endpoint?

[SanfordWhiteman]

Sure, it works in an embedded form just fine.

Greg went deeper into some of the steps in this offsite doc. It should be wrapped up in a Products blog post at some point.

[Ishita_Chawra]

Hi @SanfordWhiteman @Grégoire_Miche2 

I'm following this offsite doc "https://www.evernote.com/l/ABhkduhjxMVPHZCUFDBpt8J5wgwKqjIzElg" and was able to get the Google reCAPTCHA V2 Checkbox working in the form/LP.

Question 1. But I'm getting the below message when I go to the Google reCAPTCHA Admin Console that the verification is not working. 

Question 2. I'm not able to follow the steps in the document related to "Setup of form fill out Smart campaign" Could you help me understand the steps here:

1. Does the first screenshot here say to create a smart list only?
2. In the call webhook smart campaign screenshot what should be under the smart list?
3. Are there 2 smart campaigns and 1 smart list and 1 email?
4. flow screenshot starts at step 2 what is step 1 here?
5. What does the email "20180319-Google recaptcha test.alert" contain?

Thanks, 

IC

[SanfordWhiteman]

I would have to see all of your setup, not just the error from Google. 

That doc is pretty out-of-date, not the way we set up reCAPTCHA now. (There isn't at this time a public doc of our standard implementation.)

[rishabh_Sethi]

Hi,

I am in the same process of implementing ReCaptcha on MKTO forms. I am also following the same document as you have mentioned in the comment. Where are the roadblocks and what are the important things I need to take care of when implementing this. Can you please share some of your inputs? 

I would really appreciate it.

Thanks