A public form gets bots. Formulus stops them in several layers, and none of them asks the visitor for any effort.
Always on, nothing to set
- A honeypot: an invisible field, off screen, out of the keyboard order and hidden from screen readers. A human does not see it; a bot that fills everything in fills it in, and its submission is refused.
- A minimum delay: a submission made less than three seconds after the form appeared is refused. Nobody fills in a form that fast.
Neither sends any data to anyone.
The CAPTCHA
Protection tab, CAPTCHA setting: a CAPTCHA plugin installed in Joomla, on top. Only enabled plugins are offered.
The recommended one is Joomla 6's own, Captcha - Proof of Work. The visitor's computer does a small calculation: no picture challenge, no outside service, no cookie. Formulus enables it on installation, and every model chooses it.
The "I'm not a robot" box ticks itself, and that is normal: the calculation starts as soon as the visitor enters the form, and the box says so when it is done. It is the plugin's Automatic solving setting.
If the plugin is disabled, a banner on the form screen says so and offers to enable it in one click.
The boxes that commit
The Consent and Terms acceptance boxes must be ticked for the submission to go through, even if someone bypasses the browser. Their link to the text to read (terms and conditions, privacy policy) is set behind the field's cog, All settings of this field, General tab: a site menu item, or an address. The link opens in a new window, and this is announced.
A terms box without a link leads the visitor nowhere: they accept a text they cannot read. Formulus then shows a warning at the top of the Fields tab, with a button leading to the setting.
Up to date for Formulus 1.0.237.