call Contact
shield Optimization Tip

Forms Without CAPTCHAs

Contact forms are among the most common targets of automated spam bots. Most websites defend themselves with CAPTCHAs or Google reCAPTCHA – at the cost of usability, accessibility, and often privacy too. The TYPO3 extension Form SpamShield takes a different approach: it detects bots by behavior, with no visible security challenge at all.

history Letzte Änderung: 06.07.2026

Why CAPTCHAs Are Often the Wrong Solution

Distorted letters, image puzzles with traffic lights or crosswalks, small math problems – classic CAPTCHAs usually protect reliably against spam, but cost time and patience. Especially on mobile devices, they often cause visitors to abandon filling out a form. On top of that, many CAPTCHA systems are difficult to access for people with physical impairments or assistive technologies.

privacy_tip

External services like Google reCAPTCHA also transmit data to third parties – an important point for government bodies, public institutions, and any project with strict privacy requirements.

How Form SpamShield Works

Instead of actively challenging the visitor, Form SpamShield observes in the background whether someone behaves like a human. Using JavaScript, it evaluates technical interactions – such as mouse movements, keyboard input, or browser window size. No personal data is processed in the process. If JavaScript is disabled, the extension cautiously flags the visitor as a possible bot for safety.

A validator then evaluates the collected signals. A security level from 1 to 10 can be set for each form: at level 1, it's enough for about 10% of checks to pass, while at level 10 all checks must pass. According to the developer, a level of 7 or 8 is recommended for most websites – a good compromise between security and comfortable usability.

timer

Additional protection mechanisms can also be enabled: a minimum time window before a form can be submitted at all (bots are usually much faster than humans), a "strict mode" for especially restricted environments like kiosk systems, and a check for whether at least one space character was entered – a sign of genuine free text rather than a randomly generated string.

checklist Benefits

Benefits at a Glance

  • verified_user

    Reliable bot detection: Behavior-based analysis instead of a visible security challenge.

  • block

    No annoying CAPTCHAs: Visitors fill out the form with no extra hurdle.

  • thumb_up

    High usability: Noticeably fewer form abandonments, especially on mobile devices.

  • privacy_tip

    Privacy-friendly: The check runs entirely on your own server, with no external services.

  • tune

    Flexible configuration: Security level, time window, and further checks can be adjusted per form.

  • accessibility_new

    Accessibility-friendly: With a sensibly chosen security level, no unnecessary hurdles for people with motor impairments.

Important to Know

Form SpamShield only works with the TYPO3 system extension EXT:form. Websites currently using powermail or another form extension can't use Form SpamShield directly. We support both integration into existing EXT:form forms and migrating from powermail to EXT:form – including setup, configuration, and ongoing maintenance.

accessibility_new

The highest security levels, 9 and 10, should only be used in exceptional cases, since people with motor impairments don't always use a mouse or interact with a website in the usual way. A level of 7 or 8 already offers very good protection in most projects without unnecessarily restricting accessibility.

Want to protect your TYPO3 forms from spam without CAPTCHAs?

We handle installing Form SpamShield and adapting your forms – or advise you on migrating from powermail to EXT:form.

chat Free Consultation