How To Add CAPTCHA Protection to Drupal 8 Webform

  • Recently launched a new Drupal 8 website and was surprised by a large amount of spam received via the website's contact form (built with the Webform module).
  • To combat the spam, manually blocked each spammer's IP at first, but eventually installed the Captcha module to prevent automated spam submissions.
  • To configure Captcha for a Webform, enable the node_webform_form in the Captcha module's Form settings and enter the form_id of the Webform in the "Form ID" field. Consider using the AntiBot module as another effective tool to combat webform spam.

| Drupal Development | 71 seen

Recently I launched a new Drupal 8 website and was surprised by a spam amount we got via website's contact form (built with Webform module). 

As the website was new, I was manually blocking each spammers IP, but the amount got larger and larger, to avoid that, I decided to install Captcha module, just like in the case with Drupal 7, see: Adding CAPTCHA to Drupal 7 Webform

A CAPTCHA is a challenge-response test most often placed within web forms to determine whether the user is human. The purpose of CAPTCHA is to block form submissions by spambots, which are automated scripts that post spam content everywhere they can. The CAPTCHA module provides this feature to virtually any user-facing web form on a Drupal site.

I will assume, you have already configured your webform, now let's add captcha to it, and keep those spammers away 

Go to admin/config/people/captcha click on the tab Form settings, as we are using Webform module here, enable node_webform_form 

Drupal 8 configuring captcha module

Drupal 8 configuring captcha module

Once, enabled, click edit and in the blank text box under "Form ID" enter the form_id (not the node id) of the webform and save the configuration. 

To quickly find the form_id of the webform, take the node id and insert it to "webform_submission_contact_node_XXX_add_form", for example, if the node id is 6 your webform form_id will be "webform_submission_contact_node_6_add_form". You can also use firebug to inspect the form_id field.

Go to the webform page (as an Anonymous user) and you should be able to see the captcha there.

Captcha enabled on Drupal 8 webform

Captcha enabled on Drupal 8 webform

Another quite effective way to fight webspam is by using the AntiBot module, see my article here: Fighting Webform Spam - Drupal 9 - AntiBot

If you're in need of someone with expertise in Drupal development and module configuration, I might be just the person you're looking for. As the founder of, a Drupal development agency, I have years of experience working with this platform and helping clients achieve their goals through custom Drupal installations. Learn more at