Captcha & Email Verification Setup for Research Recruitment

This guide walks you through adding CAPTCHA and email verification to your research recruitment form. You’ll learn how to block bots, confirm participant identities, and reduce fraudulent responses—all while keeping the sign-up process smooth for legitimate volunteers. By the end, you’ll have a secure recruitment pipeline ready for data collection.

What You’ll Need

• A web form (Google Forms, Typeform, or a custom HTML form) where participants sign up.
• Access to the form’s backend or settings (for custom forms, you’ll need basic coding knowledge).
• A CAPTCHA service account (e.g., Google reCAPTCHA, hCaptcha, or Cloudflare Turnstile).
• An email sending service (e.g., SMTP, SendGrid, or your email host’s SMTP) to send verification links.
• A database or spreadsheet to store participant emails and verification status.
• For custom forms: a server or serverless function (e.g., Node.js, Python, PHP) to handle verification logic.

Step-by-Step

1. Set up your CAPTCHA service
   • Go to the CAPTCHA provider’s website (e.g., Google reCAPTCHA) and register your site.
   • Add your domain (e.g., yourlab.com) and choose the type: reCAPTCHA v2 (checkbox) or v3 (invisible). For research, v2 is often better because it’s user-friendly and shows a clear challenge.
   • You’ll receive two keys: a site key (public) and a secret key (private). Keep the secret key server-side only.
2. Add CAPTCHA to your recruitment form
   • If using Google Forms: you can’t add reCAPTCHA directly. Instead, embed your form on a webpage and add the CAPTCHA widget around it, or switch to a form builder that supports CAPTCHA (e.g., Typeform).
   • If using a custom form: insert the CAPTCHA script in the HTML head and place the widget in your form. For reCAPTCHA v2, add <div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div> and load the script.
   • Example for reCAPTCHA v2:

     <script src="https://www.google.com/recaptcha/api.js" async defer></script>
     <form action="/submit" method="post">
       <!-- your fields -->
       <div class="g-recaptcha" data-sitekey="6Lc..."></div>
       <input type="submit" value="Sign Up">
     </form>

3. Validate CAPTCHA on the server
   • When the form is submitted, your server receives a g-recaptcha-response token.
   • Send a POST request to the provider’s verification endpoint (e.g., https://www.google.com/recaptcha/api/siteverify) with your secret key and the token.
   • Check the response: if success is true, proceed; otherwise, reject the submission with an error message.
   • Example in Node.js:

     const verify = await fetch('https://www.google.com/recaptcha/api/siteverify', {
       method: 'POST',
       body: `secret=${SECRET}&response=${token}`,
       headers: {'Content-Type': 'application/x-www-form-urlencoded'}
     }).then(r => r.json());
     if (!verify.success) return res.status(400).send('CAPTCHA failed');

4. Collect participant email and store it
   • Add an email field to your form. Validate it on the client side (e.g., using HTML5 type="email") and on the server.
   • Store the email in your database with a status field like verified = false and a unique verification token (a random string).
   • Generate the token with a secure method: crypto.randomBytes(32).toString('hex') in Node.js, or bin2hex(random_bytes(32)) in PHP.
5. Send the verification email
   • Compose an email with a link to your verification endpoint: https://yourlab.com/verify?token=GENERATED_TOKEN.
   • Use your email service’s API or SMTP to send it. Include a clear subject like “Please verify your email for the study”.
   • Set the link to expire (e.g., 24 hours) for security.
   • Example with Node.js and Nodemailer:

     await transporter.sendMail({
       to: email,
       subject: 'Verify your email',
       html: `Click here`
     });

6. Create the verification endpoint
   • When a user clicks the link, your server receives the token.
   • Look up the token in your database. If found and not expired, set verified = true and delete the token (or mark it used).
   • Redirect the user to a confirmation page saying “Email verified, thank you!”.
   • If the token is invalid or expired, show an error and offer a resend option.
7. Only allow verified participants to proceed
   • In your recruitment workflow, filter out unverified emails. For example, if you’re sending follow-up surveys, only send to those with verified = true.
   • If your form is multi-step, require verification before the final submission.
8. Test the entire flow
   • Submit the form with a real email and complete the CAPTCHA.
   • Check that the verification email arrives (check spam folder).
   • Click the link and confirm the status changes in your database.
   • Try submitting with a wrong CAPTCHA or an invalid token to ensure errors are handled.

Common Mistakes

• Exposing your secret key in front-end code. Always keep it server-side.
• Not validating the CAPTCHA response server-side. Client-side validation is not enough.
• Using a weak verification token (e.g., timestamp) that can be guessed.
• Allowing the verification link to be used multiple times without expiring or invalidating it.
• Forgetting to handle email bounces—if the email is invalid, the participant never gets verified.
• Making the CAPTCHA too hard (e.g., distorted text) which frustrates participants and reduces sign-ups.

Tips

• Use reCAPTCHA v3 if you want a frictionless experience—it scores users silently, but you’ll need to set a threshold (e.g., 0.5).
• Send the verification email immediately after sign-up to reduce drop-off.
• Include a clear explanation in the email about why verification is needed (e.g., “to ensure data quality”).
• Set a reasonable expiration (24–48 hours) and allow resending.
• Keep a log of verification attempts for troubleshooting, but avoid storing raw tokens.
• Consider using a double opt-in for research studies—this is standard practice for ethical data collection.

Troubleshooting

• CAPTCHA not showing: Check that your site key is correct and the script is loaded. Make sure the domain matches the one registered.
• CAPTCHA always fails: Verify your secret key is correct and that you’re sending the token to the right endpoint. Check if your server’s clock is synchronized (important for timestamp validation).
• Verification email not arriving: Check spam folders, ensure your email service is configured (SPF/DKIM records), and test with a different email provider.
• Link says invalid token: The token may be expired or already used. Check your database for the token’s status and expiration time.
• Participants report the CAPTCHA is too hard: Switch to a simpler CAPTCHA type (e.g., checkbox instead of image puzzles) or use invisible reCAPTCHA.
• Duplicate submissions: Implement a check for existing emails before adding a new record, or use a unique constraint on the email field.

Frequently Asked Questions

Do I need both CAPTCHA and email verification?

Not strictly, but they serve different purposes. CAPTCHA blocks automated bots, while email verification confirms a human has access to that email address. Together, they significantly reduce fraudulent sign-ups.

Can I use Google Forms with CAPTCHA?

Google Forms doesn’t support CAPTCHA directly. You can embed the form on a webpage and add a CAPTCHA widget around it, but the form itself won’t have one. For a seamless experience, consider using a form builder that supports CAPTCHA or build a custom form.

How long should the verification link be valid?

Typically 24–48 hours. Longer periods increase the risk of token theft, while shorter ones may inconvenience participants who delay checking their email.

What if a participant never verifies their email?

You can send a reminder after 24 hours, and then remove them from your active recruitment list after 72 hours. For research, it’s acceptable to exclude unverified participants to maintain data integrity.

Is reCAPTCHA v2 or v3 better for research?

v2 (checkbox) is more transparent and user-friendly for a general audience. v3 is invisible but requires you to set a score threshold, which may incorrectly block some legitimate users. For most research, v2 is recommended.

Can I use a free email service to send verification emails?

Yes, services like SendGrid’s free tier or your email host’s SMTP can work. However, be aware of sending limits and ensure your emails aren’t marked as spam.

Related

• Dragon’s Dogma 2 Lock On: How Targeting Works
• How to Cancel Grok Subscription & Stop Charges
• Could Not Invite the Provided Name: Fixes