AEM Forms Cloud Service: reCAPTCHA Enterprise score-based threshold blocks repeated submissions
✨ This content is AI generated and could be inaccurate. Generative AI Terms
This article explains why AEM Forms using reCAPTCHA Enterprise with a score-based threshold may block legitimate repeated submissions and outlines supported configuration alternatives.
Description description
Environment
- Adobe Experience Manager (AEM) Forms as a Cloud Service (all versions)
Symptoms
When using AEM Adaptive Forms with Google Enterprise Invisible reCAPTCHA (score-based, threshold set to 0.7), repeated submissions from the same device can result in the reCAPTCHA service returning a low score (e.g., 0.4). This causes the form submission to fail validation, as the system treats it as suspicious automated activity. No error messages are displayed to the end user, but legitimate submissions are blocked after several consecutive form entries from the same machine.
Cause
reCAPTCHA Enterprise score-based configuration in AEM Forms only accepts submissions above the set threshold and does not support interactive challenges for low scores. Multiple submissions from the same device can be flagged as suspicious by reCAPTCHA, resulting in legitimate submissions being blocked.
Resolution resolution
Follow the steps below to resolve the issue:
-
Understand that AEM Forms as a Cloud Service does not provide an out-of-the-box mechanism to switch from score-based reCAPTCHA Enterprise to an image challenge when a submission falls below the threshold. Submissions below the configured threshold are rejected without an interactive challenge.
-
Consider supported alternatives:
-
Option 1: Use reCAPTCHA v2 with the Invisible option. Create a reCAPTCHA v2 cloud configuration in AEM (navigate to Tools
>Cloud Services>reCAPTCHA). Select the Invisible option in the captcha component. This configuration keeps the check invisible for most users but displays a challenge if suspicious activity is detected. -
Option 2: Use Checkbox key type with reCAPTCHA Enterprise. In your Google Cloud project, create a Checkbox site key. In AEM, create a reCAPTCHA Enterprise cloud configuration with the key type set to Checkbox. This displays a visible checkbox and allows users to complete a challenge if needed, ensuring legitimate submissions are not rejected solely on score.
-
Option 3: Adjust the threshold on the existing score-based configuration. Lower the threshold score in the reCAPTCHA Enterprise cloud configuration (e.g., from 0.7 to a lower value). This will allow more submissions to pass, but may reduce the strictness of bot detection. Test and validate the new threshold with your actual traffic patterns.
-
Option 4: Use separate configurations for different audiences. Assign different reCAPTCHA configurations per form using the configuration container. For example, keep a stricter score-based setup for public forms and use one of the above options for forms used by trusted users.
-
-
Placement and timing recommendations:
-
Place the captcha component just before the Submit button.
-
Avoid placing the captcha in a fragment or in a panel marked for lazy loading.
-
Only one captcha component per form is supported.
-
reCAPTCHA validation expires after a few minutes; ensure users submit promptly after completing the captcha.
-
-
Test and validate the chosen configuration to ensure it meets your requirements.