How To Add CAPTCHA Protection to Drupal 8 Webform

  • Recently launched a new Drupal 8 website and was surprised by a large amount of spam received via the website's contact form (built with the Webform module).
  • To combat the spam, manually blocked each spammer's IP at first, but eventually installed the Captcha module to prevent automated spam submissions.
  • To configure Captcha for a Webform, enable the node_webform_form in the Captcha module's Form settings and enter the form_id of the Webform in the "Form ID" field. Consider using the AntiBot module as another effective tool to combat webform spam.

| Drupal Development | 241 seen

Recently I launched a new Drupal 8 website and was surprised by a spam amount we got via website's contact form (built with Webform module). 

As the website was new, I was manually blocking each spammers IP, but the amount got larger and larger, to avoid that, I decided to install Captcha module, just like in the case with Drupal 7, see: Adding CAPTCHA to Drupal 7 Webform

A CAPTCHA is a challenge-response test most often placed within web forms to determine whether the user is human. The purpose of CAPTCHA is to block form submissions by spambots, which are automated scripts that post spam content everywhere they can. The CAPTCHA module provides this feature to virtually any user-facing web form on a Drupal site.

I will assume, you have already configured your webform, now let's add captcha to it, and keep those spammers away 

Go to admin/config/people/captcha click on the tab Form settings, as we are using Webform module here, enable node_webform_form 

Drupal 8 configuring captcha module

Drupal 8 configuring captcha module

Once, enabled, click edit and in the blank text box under "Form ID" enter the form_id (not the node id) of the webform and save the configuration. 

To quickly find the form_id of the webform, take the node id and insert it to "webform_submission_contact_node_XXX_add_form", for example, if the node id is 6 your webform form_id will be "webform_submission_contact_node_6_add_form". You can also use firebug to inspect the form_id field.

Go to the webform page (as an Anonymous user) and you should be able to see the captcha there.

Captcha enabled on Drupal 8 webform

Captcha enabled on Drupal 8 webform

Another quite effective way to fight webspam is by using the AntiBot module, see my article here: Fighting Webform Spam - Drupal 9 - AntiBot


If you're in need of someone with expertise in Drupal development and module configuration, I might be just the person you're looking for. As the founder of Terramatris.eu, a Drupal development agency, I have years of experience working with this platform and helping clients achieve their goals through custom Drupal installations. Learn more at Terramatris.eu

 

Latest articles

Embedded thumbnail for Mumbai & Goa / India Trip

Mumbai & Goa / India Trip

It has already become something of a tradition for us - escaping the cold during our daughter’s winter school break and trading grey skies for warmth, color, and a slower rhythm of life. Each year, we carve out about three weeks to leave Tbilisi behind and head somewhere sunnier. And more often than not, that “somewhere” turns out to be India.Our…

India |

RWA Tokenization in Georgia: Key Takeaways from DGFI & Forbes Conference in Tbilisi

On April 24, 2026, DGFI, in collaboration with Forbes Georgia, hosted a conference on Real-World Asset (RWA) tokenization at the Radisson Blu Iveria Hotel in Tbilisi. The event brought together representatives from financial institutions, regulators, brokerage houses, and emerging fintech players to discuss the evolving landscape of tokenized…

Living in Georgia |