Adding Google reCAPTCHA to a Registration Form in MODX Evolution

Spam registrations are one of the fastest ways to burn through mail limits and damage trust in a public form. A common real-world case came from a Shopkeeper-based site with an AJAX registration popup where bots kept submitting fake email addresses until the hosting provider disabled outgoing mail.

The practical fix is to add reCAPTCHA at the template level and validate it before the registration flow continues. In older Evolution CMS sites that usually means touching the registration snippet or the eForm-based wrapper that powers the popup.

What to check first

• identify which registration flow the site actually uses: eForm, WebSignup, or a custom AJAX endpoint
• add the reCAPTCHA placeholder to the template, not to a random include file
• validate the token server-side before creating a user or sending mail

Template-side placeholder

<div class="signup-form">
    ...
    [+ReCaptcha+]
    ...
</div>

Why the 500 error happened

the discussion mentioned adding [+ReCaptcha+] directly to websignup.inc.php. That is the wrong layer. Placeholders belong in the rendered template or chunk. PHP include files expect PHP, not template tags, so dropping a placeholder there can easily break the request.

Best-practice approach

• render the widget in the form markup
• validate the response before processing the registration
• log failed attempts so you can spot spam waves early
• keep the registration endpoint rate-limited if the site is under active attack

If you are maintaining an older project, start with the simplest safe change: move the widget into the form template, verify the validation step, and test the full AJAX flow from the front end instead of editing registration core files directly.