Multi-level protection for Bitrix forms: how we reduced spam by 95%
We encountered a project where 95% of submissions were spam: CRM was clogged with junk leads, email queues overloaded, analytics distorted. Monthly losses on manual moderation reached hundreds of thousands of rubles. After implementing our protection, server load decreased threefold, and moderation costs dropped by 90%. On another project with 5000 forms per day, the client saved significant funds through automated filtering. Standard Bitrix CAPTCHA (bitrix:main.captcha) — an image with symbols — practically doesn't work: modern bots recognize it with 95%+ accuracy. A multi-level approach is needed that doesn't require extra actions from the user and doesn't break UX.
Why one method is not enough?
Each protection method has weaknesses. Honeypot stops simple bots, but smart ones bypass hidden fields. Timing blocks instant submissions, but some bots can delay. Rate limiter is effective against mass attacks but doesn't protect against distributed ones. By combining them, we cover all vectors.
For example, honeypot filters out 80% of bots, but the remaining 20% are smart bots that bypass hidden fields. Timing catches another 50% of those, but some bots emulate delays. Rate limiter completes the picture, blocking repeat attacks from a single source. Such a combination gives a cumulative effectiveness of 95%+.
Which methods protect against spam?
Honeypot: hidden field for bots
We add a hidden field to the form that bots fill in, but humans don't. The server checks: if the field is not empty — silently ignore the request.
<div style="position:absolute;left:-9999px;top:-9999px;opacity:0;height:0;overflow:hidden"> <label for="email_confirm">Leave empty</label> <input type="text" id="email_confirm" name="email_confirm" tabindex="-1" autocomplete="off" value=""> </div> // Серверная проверка if (!empty($data['email_confirm'])) { echo json_encode(['success' => true]); exit; } Timing: protection against fast submissions
On render, we write a timestamp into a hidden field. On the server, we check: if less than 3 seconds have passed — it's a bot (silent success). If more than an hour — session expired.
$formToken = base64_encode(json_encode([ 'ts' => time(), 'sessid' => bitrix_sessid(), ])); // в шаблоне: <input type="hidden" name="form_token" value="<?= htmlspecialchars($formToken) ?>"> // Проверка $token = json_decode(base64_decode($data['form_token'] ?? ''), true); $timeElapsed = time() - (int)($token['ts'] ?? 0); if ($timeElapsed < 3) { $this->markSpam('timing', $timeElapsed); exit(json_encode(['success' => true])); } if ($timeElapsed > 3600) { exit(json_encode(['success' => false, 'error' => 'Сессия истекла. Обновите страницу.'])); } Rate limiter: limiting request frequency
Extended example of RateLimiter class
We limit the number of submissions from one IP, email, or phone per period. We use Bitrix cache or Redis.
class RateLimiter { private const LIMITS = [ 'ip' => ['max' => 5, 'window' => 3600], 'email' => ['max' => 3, 'window' => 86400], 'phone' => ['max' => 2, 'window' => 86400], ]; public function check(string $type, string $identifier): bool { $limit = self::LIMITS[$type] ?? ['max' => 3, 'window' => 3600]; $key = 'spam_rl_'.$type.'_'.md5($identifier); $cache = \Bitrix\Main\Application::getInstance()->getManagedCache(); $count = (int)$cache->get($key); if ($count >= $limit['max']) { \CEventLog::Add([ 'SEVERITY' => 'WARNING', 'AUDIT_TYPE_ID' => 'SPAM_BLOCKED', 'MODULE_ID' => 'local.antispam', 'DESCRIPTION' => "Blocked: type={$type}, id={$identifier}", ]); return false; } $cache->set($key, $count + 1, $limit['window']); return true; } } In the Bitrix event log (CEventLog), we record: attack type, identifier, IP, time. This helps analyze patterns and adjust limits.
Additionally, we check email for disposable domains and MX records, and phone by format and blacklists. This filters out another ~60% of residual spam.
Which captcha to choose for a Russian site?
For Russian audiences, Google reCAPTCHA may be blocked. We use Yandex SmartCaptcha or Cloudflare Turnstile — they work without VPN and don't require entering symbols. Integration is similar: frontend gets a token, server verifies via API.
// Yandex SmartCaptcha function verifyYandexCaptcha(string $token): bool { $ch = curl_init('https://smartcaptcha.yandexcloud.net/validate'); curl_setopt_array($ch, [ CURLOPT_POST => true, CURLOPT_POSTFIELDS => http_build_query([ 'secret' => $secretKey, 'token' => $token, 'ip' => $_SERVER['REMOTE_ADDR'], ]), CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 5, ]); $result = json_decode(curl_exec($ch), true); curl_close($ch); return ($result['status'] ?? '') === 'ok'; } Provider comparison and their effectiveness
| Provider | Verification type | Availability in Russia | UX | Effectiveness |
|---|---|---|---|---|
| reCAPTCHA v3 | No-captcha (score) | Unstable | High | 90–95% |
| Yandex SmartCaptcha | No-captcha / button | Stable | High | 90–95% |
| Cloudflare Turnstile | No-captcha | Stable | High | 85–90% |
Effectiveness of combining basic anti-spam methods:
| Method | Description | Effectiveness |
|---|---|---|
| Honeypot | Hidden field for bots | ~80% spam |
| Timing | Submission faster than 3s = bot | ~50% bots |
| Rate limiter | Limit submissions from one IP | ~70% mass attacks |
| reCAPTCHA v3 / Turnstile | No-captcha verification | 90–95% |
| Email/phone check | MX record, disposable domains, blacklists | ~60% residual |
What's included in our anti-spam package?
Work stages
- Analytics — gather requirements, audit existing forms and load.
- Design — choose methods, architecture considering cache and performance.
- Implementation — develop module, write code, unit tests.
- Test — load testing (simulate bots), check UX.
- Deploy — roll out on production server, monitor first days.
Timeline and cost
Basic set (honeypot + timing + rate limiter) — 3–5 days. Full stack with SmartCaptcha and dashboard — 1–2 weeks. Cost is calculated individually based on form volume and load. On average, budget savings on spam — up to 90% of moderation costs.
What if rate limiter blocks real users?
We configure adaptive limits: for example, after 3 submissions from one IP per hour, we show captcha instead of full blocking. We also maintain logs and analyze false positives, adjusting thresholds.
Why choose us?
We are a team of certified 1C-Bitrix specialists with experience on over 50 projects in form protection. Our solutions are tested on projects with 10,000+ submissions per day. We guarantee support and refinements after deployment. Order a preliminary assessment of your project — get a consultation and timeline estimate. Contact us for a preliminary evaluation of your current forms.