# Ensure CAPTCHA is enabled on signup/login/password-reset

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103907005781-ensure-captcha-is-enabled-on-signuploginpassword-reset
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure CAPTCHA protection is enabled for the project using hCaptcha or Cloudflare Turnstile, so that the sign-up, sign-in, and password reset endpoints require a valid CAPTCHA token. The application's forms must include the CAPTCHA widget and send its token to Supabase Auth.

**Rationale**

Automated bots can create large numbers of fake accounts, try many passwords against real accounts, or flood users with password reset emails. CAPTCHA makes these attacks much harder because each request must include a token that proves a human completed the check. This protects both the application and its users from automated abuse.

**Impact**

-   Blocks most automated sign-up and login attacks
    
-   Reduces fake accounts and email abuse
    
-   The application must add the CAPTCHA widget to its forms
    

**Default Value**

By default, CAPTCHA protection is disabled.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   An hCaptcha or Cloudflare Turnstile account with a site key and secret key
    
-   Application changes to add the CAPTCHA widget
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select Attack Protection.
    
4.  Verify that Enable CAPTCHA protection is turned on.
    
5.  If it is off, follow the implementation steps.
    

**Implementation Steps**

1.  Add the CAPTCHA widget to the application's sign-up, sign-in, and password reset forms, and pass the token to Supabase Auth.
    
2.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
3.  Select your project.
    
4.  Open Authentication in the sidebar and select Attack Protection.
    
5.  Turn on Enable CAPTCHA protection.
    
6.  Select your CAPTCHA provider and enter the secret key.
    
7.  Select Save.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select Attack Protection.
    
4.  Turn off Enable CAPTCHA protection.
    
5.  Select Save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/auth-captcha](https://supabase.com/docs/guides/auth/auth-captcha)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.