powermailrecaptcha for TYPO3

Powermail without spam protection becomes a junk pile within weeks

Next to the core form framework, Powermail is the most widely used form extension for TYPO3. Over 2.7 million downloads (as of Packagist, September 2026), from contact forms to application forms to complex multi-step inquiry workflows. The problem: every publicly accessible form without a CAPTCHA will eventually be found by bots. Typical result: 200 to 500 spam entries per day, overflowing inboxes, noisy statistics and forms that staff eventually ignore - including the genuine inquiries within.

powermailrecaptcha is the official companion to Powermail that integrates Google reCAPTCHA v2 into Powermail forms. The extension is maintained by in2code (the Powermail developer), and each version is matched to the corresponding Powermail series.

Typical use cases

Contact forms on corporate websites. The standard scenario: a form with name, email, message and submit button. Without CAPTCHA, 50 to 300 spam messages arrive daily, mostly with links to pharmaceutical or casino sites. powermailrecaptcha uses the reCAPTCHA v2 checkbox here: one click for the user, and on suspicious behavior Google adds an image challenge. Anyone who fails the check is classified as bot and the submission is blocked.

Application forms with file upload. Career pages where applicants upload CVs and cover letters are particularly spam-prone because bots distribute malware through the upload function. reCAPTCHA filters the automated submissions. Additionally, server-side file type validation (PDF, DOCX only) and a size limit (max. 10 MB) should be active.

Multi-step forms with conditional logic. With the add-on extension powermail_cond, Powermail can build forms with conditions: if “Industry = Real Estate” is selected, additional fields appear. For such forms, a CAPTCHA on the last page before submission suffices. powermailrecaptcha provides its own field type for this, which can be placed on that last page, so it works with multi-step forms as well.

Technical architecture

powermailrecaptcha extends Powermail through its spam shield: its own spam shield method and, since version 13.1.0, a validator, both registered via TypoScript. When rendering the form, the reCAPTCHA JavaScript is embedded (from google.com/recaptcha/api.js). On submission, the reCAPTCHA token is validated server-side: TYPO3 calls https://www.google.com/recaptcha/api/siteverify with the token and secret key as URL parameters. Google responds with a confirmation (success).

Configuration is done through TypoScript constants: Site Key and Secret Key (from the Google reCAPTCHA Admin Console) and the language of the widget. The keys are maintained in the TYPO3 backend under Constants, ideally via environment variables so they do not end up in the Git repository.

powermailrecaptcha only renders the reCAPTCHA v2 checkbox and does not support invisible variants such as v3 or v2 Invisible. The familiar “I’m not a robot” widget appears. On suspicious behavior, Google additionally shows a challenge (image selection) after the click.

Common problems and solutions

GDPR concerns about Google connection. reCAPTCHA loads JavaScript from Google servers and transmits the user’s IP address to Google. Without consent, this is a real risk. Solution: only load reCAPTCHA when the user has consented via cookie banner (consent integration). Or switch entirely to alternatives: Friendly Captcha (German provider, no tracking, EU endpoint from the Advanced plan), hCaptcha (US provider that processes data in the US) or a pure honeypot strategy without external services.

reCAPTCHA v3 blocks real users. The scoring algorithm is a black box. Some real users (e.g. behind VPN, with ad blocker, on older devices) receive low scores and are incorrectly blocked. Solution: in your own v3 integration, set the threshold to 0.3 instead of 0.5 and additionally implement a honeypot field; powermailrecaptcha itself uses the v2 checkbox. Alternatively: display a fallback to reCAPTCHA v2 Checkbox on low scores instead of blocking outright.

Extension conflict with Content Security Policy. Since TYPO3 v12, the Core supports Content Security Policies (CSP). reCAPTCHA JavaScript from google.com must be permitted in the CSP, otherwise it is blocked. Solution: add script-src for https://www.google.com/recaptcha/ and https://www.gstatic.com/recaptcha/, frame-src for https://www.google.com/recaptcha/ and https://recaptcha.google.com/recaptcha/ and connect-src for https://www.google.com/recaptcha/ in the CSP configuration.

Migration and version compatibility

powermailrecaptcha supports TYPO3 v11 and v12 with the 5.2.x series and TYPO3 v13 since version 13.0.0. The extension follows Powermail’s release cycle: for TYPO3 v13, powermailrecaptcha came four weeks after Powermail, for v12 seven months later. For TYPO3 v14, both are so far only available in in2code’s Early Access Program; the free releases are announced for January 2027.

For projects switching from reCAPTCHA to a more GDPR-friendly alternative, the conversion is manageable. Friendly Captcha offers its own Powermail field through the extension friendlycaptcha_official by Studio Mitte, which takes the place of the reCAPTCHA field: install the extension, enter keys, swap the field in the form, deactivate powermailrecaptcha. The rest of the form configuration in Powermail remains unchanged. Gosign recommends Friendly Captcha as the default for new projects and offers migration of existing forms as a fixed-price service.

An often overlooked aspect is spam prevention beyond CAPTCHAs. Powermail natively offers a honeypot field (an invisible form field that only bots fill in). Combined with a time check (form must be open for at least 3 seconds before submission), the majority of automated spam can be filtered without external services. Gosign deploys a three-layer strategy for projects where GDPR compliance is the priority: honeypot and time check as the first layer (zero external requests), Friendly Captcha as the second layer (EU servers) and server-side content analysis as the third layer (link density, language, known spam patterns). This combination achieves a spam detection rate of over 99% without Google services.

For switching from powermailrecaptcha to Friendly Captcha, Gosign estimates 2 to 4 hours per website, including installation, configuration, testing all forms and deactivating the old extension.