I#'m using and the rwd theme, however since our site went online I'm getting many spam Mails via contact form. I already downloaded the Re-Captcha extension but it doesn't fit in our theme. How can I protect my site from spam?


3 Answers 3


As you have mentioned Re-Captcha isn't fit in your theme. A CAPTCHA is not very user friendly and statics have shown that it can be cracked. This free solution to prevent spam might be very useful to you.

The design of this extension reduce the size of your database entries and all spam messages are saved direct into a local text file. This extension is free to use.

URL : https://github.com/mgtcommerce/Mgt_Akismet


You can use the Google reCaptcha and create a module with an observer for this event: controller_action_predispatch_contacts_index_post

In your app/design/frontend/package/theme/template/contacts/form.phtml add the reCaptcha code from google in the contacts form (replace the "your_site_key" with yours)

    <div class="input-box">
        <div class="g-recaptcha" data-sitekey="your_site_key"></div>

Then add the javascript file to your head section: <script src='https://www.google.com/recaptcha/api.js'></script>

In Package/Modulename/etc/config.xml


Then in your observer: app/code/local/Package/Modulename/Model/Observer.php

class Package_Modulename_Model_Observer 
    const GOOGLE_CAPTCHA_URL = 'https://www.google.com/recaptcha/api/siteverify';

    public function checkCaptchaOnContact($observer)

        $controller = $observer->getControllerAction();

        //Get the recaptcha response
        $recaptchaResponse = $controller->getRequest()->getPost('g-recaptcha-response', '');
        $errorMessage = Mage::helper('core')->__('Invalid Captcha provided');

        //If recaptcha is not empty
        if ($recaptchaResponse != '') {
            $params = array(
                'secret' => $yourSecretKey, //You will need to populate this field.
                'response' => $recaptchaResponse

            //Post the data
            $curl = new Varien_Http_Adapter_Curl();
            $curl->setConfig(array('timeout' => 15, 'header' => false));
            $curl->write(Zend_Http_Client::POST, self::GOOGLE_CAPTCHA_URL, '1.1', array(), $params);
            $jsonResult = $curl->read();
            $result = json_decode($jsonResult);
            //Check result.
            if (isset($result->success) && ($result->success == 1 || $result->success == '1')) {
                return $this;
        //If there is no captcha, add error and redirect back to contacts
        $controller->setFlag('', Mage_Core_Controller_Varien_Action::FLAG_NO_DISPATCH, true);
        return $this;
  • This answer is very complete and can be used in many contexts. I had to do it in an old Magento 1 install on the Registration form to avoid spam, and this code is very useful. For those who ask how to create a module for it, go to: ashsmith.io/2012/12/making-use-of-observers-in-magento
    – Peanuts
    Nov 4, 2017 at 17:47

With the rwd theme you don't need an extension.

You can simply enable native Magento captcha under System > Configuration > Customer > Captcha.

Enable the option and choose the contact form in the multiselect field.

  • Note : available since magento 1.7 only Sep 4, 2018 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.