Acquia Documents CAPTCHA Controls for Experimental Drupal Canvas Forms

Source CMS administrators can configure a site-wide CAPTCHA layer for Drupal Canvas Forms. Acquia says in its product documentation that one provider and one enforcement mode apply to every Canvas form, with server-side CAPTCHA verification running after built-in spam controls. Acquia introduced Drupal Canvas Forms as an experimental feature on 16 July 2026.

The Monitor and Enforce modes let teams verify form setup before failed checks begin blocking submissions. Monitor logs verification results without rejecting requests, while Enforce rejects failed checks and submissions that omit the CAPTCHA token. Acquia says disabled or misconfigured CAPTCHA and provider outages do not block submissions on the CAPTCHA signal, while honeypot, rate-limit, and signed challenge-token protections continue to apply.

Acquia lists Cloudflare Turnstile, hCAPTCHA, Friendly CAPTCHA, and Google reCAPTCHA v3 as supported providers. For unauthenticated endpoints, Canvas Forms also uses a hidden honeypot, a single-use signed challenge token, and rate limiting, with a default of ten submissions per IP address every ten minutes. Generated starter code includes the CAPTCHA widget when protection is enabled. Hand-authored form components must import and render CanvasFormCaptcha.