• Resolved Veerle Verbert

    (@littlekitten)


    Whenever the honeypot is enabled on a Gravity Form (which any editor can do, even if we force hCaptcha on all forms at site level), all submissions are being marked as spam.

    With hCaptcha enabled, the version_hash param doesn’t appear in the POST payload resulting in a false positive for the honeypot. Deactivating hCaptcha resolves this behaviour, version_hash reappears.

    We noticed this behaviour today, don’t know when the issue started. On Nov 21st all was working fine. I did post on the GF support forum (since hCaptcha doesn’t have any updates since), though wanted to drop this here as well in case anyone knows a solution or is experiencing the same problem. False positives do get a ‘Thanks for contacting us! We will get in touch with you shortly.’ message (!), so visitors won’t be aware something went wrong.

    Ref: https://community.gravityforms.com/t/gravityforms-honeypot-sending-all-to-spam/18546/9

Viewing 10 replies - 1 through 10 (of 10 total)
  • Thread Starter Veerle Verbert

    (@littlekitten)

    If anyone wants to go ahead, the reply at GF; timing feels weird though:
    2.9 replaces the jQuery-based form submission handler with a new version that uses plain JavaScript, which also includes new hooks and events that developers can use to trigger their integrations. The developer of the hCaptcha plugin will most likely need to update their integration so it uses the new submission handler instead of the old one.

    Plugin Contributor kaggdesign

    (@kaggdesign)

    Hi @littlekitten,

    Thank you for reporting the issue. I do not have the latest Gravity Forms, so could you send it to my email [email protected] for testing?

    Plugin Contributor kaggdesign

    (@kaggdesign)

    A form with hCaptcha and honeypot works in Gravity Forms 2.8. I didn’t change anything in hCaptcha Gravity Forms support for a while, so changes in GF 2.9 seem to be a culprit. I can look into the issue when I have GF 2.9.

    Also, there is no need in honeypot at all when you decided to use hCaptcha. Any CAPTCHA protects better from bots than any honeypot.

    Plugin Contributor kaggdesign

    (@kaggdesign)

    I have found Gravity Forms v2.9.0.1 and do not see any issue with hCaptcha and Honeypot. The version_hash field is sent and new entry is created.

    Could you provide a link to your page with GF form?

    Thread Starter Veerle Verbert

    (@littlekitten)

    Wow, that’s fast! Thank you for checking!
    Then there must be something else going on (or they fixed it in 2.9.0.1), sorry to bother you!

    (can’t provide a link, though wouldn’t be useful to debug; I cannot risk losing more submissions, so had to turn off the hCaptcha plugin atm; I will test locally and whenever I find the cause, I’ll let you know in this ticket; might be handy for someone else)

    “Also, there is no need in honeypot at all when you decided to use hCaptcha. Any CAPTCHA protects better from bots than any honeypot.”
    True, but we have many editors and each could accidentally turn on a honeypot, it’s a GF form setting… we can never be 100% sure it will stay off.

    Thread Starter Veerle Verbert

    (@littlekitten)

    sorry, should have marked it resolved for your stats!! 🙂
    thx!!

    Plugin Contributor kaggdesign

    (@kaggdesign)

    Thank you. I have a guess after investigations. Do you use invisible hCaptcha?

    Thread Starter Veerle Verbert

    (@littlekitten)

    No, just the default one. (could still trigger the false positive on GF’s honeypot, will try to test in local env asap)

    Thread Starter Veerle Verbert

    (@littlekitten)

    fyi: I did quite some local tests, but didn’t manage to find the root cause.. both have minified js and it’s hard to read, saw that GF has had quite some ‘hot fixes’ since 2.9.0; tested with 2.9.0.5 but do not have access to a version history or older versions, so can’t pin to when exaclty it first occured..

    (I will re-test in the future, promise to get back whenever I have any news; pls do keep this resolved as it may very well be another conflict within the specific setup that fails)

    Plugin Contributor kaggdesign

    (@kaggdesign)

    OK. Thank you for your investigations. Will be happy to fix any findings.

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘HCaptcha + Gravity Forms with honeypot enabled’ is closed to new replies.