CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a vital security layer to protect your Power Pages forms from spam, bots, and automated abuse. Especially when you have public-facing forms, CAPTCHA helps ensure that only legitimate users are interacting with your portal. Power Pages supports reCAPTCHA v2 natively and allows configuration directly through site settings and form options.
This guide walks you through everything you need to know about adding CAPTCHA to your Power Pages forms.
Why Use CAPTCHA in Power Pages?
- Blocks automated bots from submitting forms
- Reduces spam entries in your database
- Protects public and unauthenticated forms
- Improves overall security posture of your portal
CAPTCHA is especially essential for:
- Registration pages
- Contact forms
- Survey or feedback submissions
- Any form accessible to anonymous users
Prerequisites
- A Power Pages site already created.
- Access to the Portal Management app or Power Pages Design Studio.
- A Google reCAPTCHA v2 Site Key and Secret Key.
Step-by-Step: How to Add CAPTCHA
Step 1: Register Your Portal on Google reCAPTCHA
- Visit https://www.google.com/recaptcha/admin
- Log in using your Google Account
- Register a new site:
- Label: (e.g.,
My Power Pages Portal) - reCAPTCHA type: Select reCAPTCHA v2 → “I’m not a robot” Checkbox
- Domains: Enter your Power Pages site domain (e.g.,
example.powerappsportals.com) - Accept the terms and submit.
- Label: (e.g.,
- Google provides two values:
- Site Key
- Secret Key
Step 2: Configure Site Settings in Portal Management
Open the Portal Management App (from Power Apps → Apps → Portal Management)
- Go to Site Settings (in the left-hand navigation)
- Create the following settings:
| Name | Value | Notes |
|---|---|---|
Authentication/Registration/EnableCaptcha | true | Enables CAPTCHA |
Authentication/Registration/CaptchaSiteKey | Your Google reCAPTCHA Site Key | From Step 1 |
Authentication/Registration/CaptchaSecretKey | Your Google reCAPTCHA Secret Key | From Step 1 |
Authentication/Registration/CaptchaTheme | light / dark | Optional |
Authentication/Registration/CaptchaType | image / audio | Optional |
These settings also apply to Entity Forms beyond the default registration page.
Step 3: Enable CAPTCHA on Your Entity Form
- Open the Portal Management App
- Go to Entity Forms
- Select the form you want to protect (e.g., “Contact Us Form”)
- Scroll down to the Additional Settings section
- Check the option:
“Show Captcha on the form” - Save and publish the changes
Step 4: Test the Form on Your Power Pages Site
- Navigate to the portal page containing the form.
- You should now see the “I’m not a robot” checkbox below the form fields.
- Submit the form as a user to verify that CAPTCHA validation is working correctly.
Optional: Add CAPTCHA Theme or Style
To style the CAPTCHA:
- Use the
Authentication/Registration/CaptchaThemesetting (lightordark) - Place the CAPTCHA box in a specific form section by customizing the form HTML/CSS
If you’re using custom forms or Web Templates, you can manually place the reCAPTCHA snippet using Google’s script tag and rendering methods. However, for most standard Entity Forms, using the native checkbox is simpler and effective.
Common Issues and Fixes
| Issue | Solution |
|---|---|
| CAPTCHA not showing | Ensure EnableCaptcha is set to true and published |
| CAPTCHA validation fails | Double-check your Site Key and Secret Key |
| CAPTCHA not visible in custom form | Consider using native Entity Forms instead of custom HTML forms |
| CAPTCHA visible but not validating | Ensure your domain matches the one configured in Google reCAPTCHA |
Best Practices
- Use CAPTCHA on all public forms (especially those not requiring login)
- Avoid using CAPTCHA on forms behind authentication unless needed
- Combine CAPTCHA with Table Permissions and Web Roles for layered security
- Regularly test the CAPTCHA functionality, especially after domain or portal changes
Summary Checklist
| Task | Status |
|---|---|
| Google reCAPTCHA registered | ✅ |
| Site Key & Secret Key generated | ✅ |
| Site Settings configured | ✅ |
| CAPTCHA enabled on the form | ✅ |
| Testing completed | ✅ |
Final Thoughts
CAPTCHA is a simple yet powerful way to protect your Power Pages site from unwanted submissions. Whether you’re building a portal for customer service, feedback collection, or registration, this extra layer of validation helps maintain data quality and security.
Always use CAPTCHA in combination with proper form permissions, input validation, and role-based access control to create a secure and user-friendly experience.