I wish to use google's new version 2.0 reCaptcha on my website.

My website displays some users' (public) information to other registered users.

Where is the best place to place the reCaptcha?

1) On my registration forms where users register.


2) As an ajax call when users click to try to view the other users' information (eg: a user will click "show phone number" and a dialog box will pop up with the reCaptcha). (this page is only accessible to registered users).

(My registration requires email validation as well).


Edit: Additional details. My website is a meeting place between people offering service and people looking for a service. As such, there is a page (only accessible to registered users) that displays users' phone numbers and allows users to send emails to other users.

There is already some protection in place (emails are sent programmatically without any email information displayed on page, phone numbers are obfuscated).

In addition to this, because private information is being displayed, I wanted to also add a reCaptcha. I can think of 2 logical places for this reCaptcha and they are listed above (points "1" and "2").

As I am not entirely familiar with how spam bots work I am not sure where it is more critical to stop them.

If option "1" is chosen, I will be stopping them from completing a user registration form for my site.

While if option "2" is chosen, I will be stopping them from viewing the restricted information once they have already succeeded in obtaining an account on my website.

In an ideal world, if these methods worked flawlessly then I could use either. However, perhaps spammers and people who scrape data perform registration without bots and then only use bots once they have a registered user for the site (in which case option "2" would be better since the registration would be performed by a human).

Or, maybe spammer/scrapers use bots for registering as well (in which case option "1" would be best since it would stop them from registering on my site).

I could always place the reCaptcha at both places (1 and 2) and will do so if it's necessary but naturally, I would like to minimize the amount of spots where I have this check

  • 2
    both? neither? What are you trying to accomplish by using a captcha?
    – schroeder
    Jan 11 '16 at 16:05
  • 3
    Wherever you want to prevent automated submissions. This will vary based on your site.
    – Matthew
    Jan 11 '16 at 16:09
  • @schroeder I'm trying to prevent robots from scraping users' information that is displayed on my site (eg: phone numbers). While I have some restrictions in place, I though captcha would be another hurdle because it would limit registration by robots (or, if I use option (2) in my question, it would restrict robots' access to certain information).
    – theyuv
    Jan 12 '16 at 7:32
  • @theyuv try editing your question with this requirement. It might get re-opened now that we know what you are needing.
    – schroeder
    Jan 12 '16 at 16:00
  • details were added.
    – theyuv
    Jan 12 '16 at 17:02

You use CAPTCHA to prevent the use of automated scripts, sometimes called "bots". So you should add CAPTCHA to any part of your workflow that you are concerned will have problems from bots. Registration is one common place where this is done.

You can't really add CAPTCHA to an API call as it is a web UI component. That said, you can add it to your website in front of an API call. Whether this is appropriate or not is not something that we can answer without understanding your website's functionality and security model.

  • Thanks, in your second paragraph are you referring to option (2) in my question? If so, I meant that I would have a dialog come up when a user tries to view sensitive information; this dialog would contain the recaptcha which would use an ajax call to check the user's validity; upon, validation, he would be allowed to view the information.
    – theyuv
    Jan 12 '16 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.