If your Odoo website lets visitors create an account, sooner or later bots find the sign-up form. The result is a contact list full of fake names, portal users nobody recognises, and welcome emails sent to addresses that do not exist — which can hurt how mail providers treat the rest of your email.
This guide shows how to put a CAPTCHA on the Odoo website registration page, and optionally on the login page, with the Custom CAPTCHA for Website Registration app.
Why a simple CAPTCHA helps
Most sign-up spam comes from automated scripts that fill in every form they find. They submit the fields they expect — name, email, password — and move on. A question that has to be read from an image and answered breaks that routine, so the request never turns into an account.
Be realistic about what it does: it stops the generic bots that fill in every form they find, not a person registering by hand or a bot written specifically for your site. For most small and mid-sized Odoo websites, the generic bots are the problem.
How the CAPTCHA works
- The visitor sees a short sum as an image — two numbers from 1 to 9, added or subtracted (for example 7 − 3 =) — and types the answer.
- The image is drawn on your Odoo server with a few noise lines, so the numbers are not plain text in the page.
- The answer is checked on the server, against the question stored in the visitor's session.
- A refresh button loads a new question if the visitor cannot read the current one.
- Because everything runs inside Odoo, there is no reCAPTCHA account, no API key and no outside service to depend on.
Step 1: Install the module
Install the app; Odoo's standard sign-up module (auth_signup) is installed with it. From that moment the CAPTCHA appears on the sign-up page, as long as customer self-registration is enabled on your website. It is also shown when an invited user sets their password.
Step 2: Test the registration page
Open your website's sign-up page in a private window. Below the usual fields you will see the CAPTCHA image, the refresh button and an answer field. Submit the form with a wrong answer: the account is not created and the page shows "Invalid CAPTCHA. Please try again." With the right answer, Odoo's normal sign-up continues as before.
Step 3: Protect the login page too (optional, Odoo 19 and 20)
Bots also try to guess passwords on the login page. On Odoo 19 and 20 you can add the CAPTCHA there: go to Settings, find the Users section and enable Login CAPTCHA. A login with a wrong CAPTCHA answer is refused just like a wrong password, and the visitor is asked to try again. The setting applies to everyone who signs in through the login page, including your internal users.
Who this is for
- Odoo websites and eShops with open customer registration.
- Companies that see fake portal users or spam contacts appearing in Odoo.
- Anyone who wants bot protection without registering for a third-party CAPTCHA service.
The app supports Odoo 18, 19 and 20 on Community and Enterprise, Odoo.sh and on-premise; the login-page option is available on Odoo 19 and 20. See the Custom CAPTCHA for Website Registration page for screenshots and the Odoo Apps Store link.
