Bot Protection on Registration Forms (reCAPTCHA & Access Control)

eWebinar protects every registration form against automated bot submissions using Google reCAPTCHA. This runs automatically, there is no toggle to enable or disable it in the editor.

How it works

When a registrant clicks the submit button, the browser sends a reCAPTCHA token in the background. The eWebinar backend verifies the token with Google's reCAPTCHA API. Legitimate human traffic passes silently; suspicious automated traffic is rejected before the registration is created.

Because eWebinar uses invisible reCAPTCHA, registrants typically don't see a challenge at all. A visible CAPTCHA challenge (the "I'm not a robot" checkbox or image puzzle) only appears in rare cases where Google's scoring system judges the interaction as suspicious.

Names that include web addresses

eWebinar also refuses registrations when a first or last name includes a web address (for example a domain or URL). The name field shows the error Names can't include web addresses. The registrant can correct the name and try again. There is no host setting for this check — it runs on every registration form automatically.

Handling spam registrations that get through

If you're seeing junk registrations from throwaway or consumer email addresses, reCAPTCHA won't catch those: they're from real humans with disposable emails, not bots. Use the email-based filters instead:

• Block disposable email domains: blocks known throwaway services like Mailinator.
• Require work emails: blocks Gmail, Hotmail, and similar consumer providers.
• Block specific emails or domains: manual blocklist for specific addresses.

The sections below explain where these access control settings live and how each one works.

Access control: where to find it

Access control settings live on the Registration tab of the eWebinar editor, under Access control. They are configured per eWebinar. If the eWebinar is part of an eWebinar Series, the series-level access control settings apply to every eWebinar in the series and override the individual eWebinar's settings.

Basic email blocklist (included with every plan)

Without any add-on, you can stop specific people from registering:

1. Open the eWebinar editor and go to the Registration tab.
2. In the Access control section, enter the addresses in Block a set of emails from registering.
3. Save your changes.

The basic blocklist takes individual email addresses only, not domains.

Advanced access control (add-on)

The Advanced access control add-on adds domain-level rules, email-quality checks, SSO, and per-session registrant caps. Turn on the Advanced Access Control toggle in the Access control section, then choose one of two modes:

Only allow certain registrants

Only people whose email address or email domain is on your list can register; everyone else is turned away.

• Enter specific email addresses and/or domains (for example partner.com or specific@contractor.com).
• If SSO is set up for your team, you can also turn on Require SSO to register and join (see Require SSO at registration below).

Block a set of registrants

Everyone can register except the emails and domains on your blocklist. In this mode you can also enable:

• Require work emails: blocks addresses from consumer providers such as gmail.com, hotmail.com, and yahoo.com. Any provider not on the consumer list is treated as a work email.
• Don't allow temporary emails: blocks known disposable or throwaway services such as Mailinator and Guerrilla Mail. The list of blocked domains is maintained by a third-party service and updated automatically.

Both toggles only look at the email domain. They do not check whether the mailbox exists; that is handled separately by eWebinar's email verification. You can combine either toggle with a manual list of specific emails and domains.

Limit the number of registrants in a session

Available in both modes. See Session capacity and full states for how the cap works and how to set it.

Require SSO at registration

When you want to be sure only authenticated employees or partners can register, you can gate an eWebinar behind your company's single sign-on. Visitors are sent to your identity provider before they can complete the registration form.

Prerequisites

• Your team is on the Enterprise plan (Enterprise SSO entitlement).
• Your team has the SSO integration configured (see Set up SSO for your team below).
• The Advanced Access Control add-on is enabled on the eWebinar, with the mode set to Only allow certain registrants.

How to enable it

1. Open the eWebinar editor and go to the Registration tab.
2. In the Access control section, turn on the Advanced Access Control toggle.
3. Select Only allow certain registrants.
4. Add the email addresses or domains you want to allow (for example yourcompany.com).
5. Turn on the Require SSO to register and join toggle that appears below the domain field.
6. Save and publish the eWebinar.

What attendees experience

When a visitor lands on the registration page, they are redirected to your identity provider to sign in. After signing in, they return to the registration form with their email pre-filled and complete the normal registration flow. Anyone who is not authenticated, or whose account does not match an allowed domain, cannot register.

For eWebinars that belong to a series, configure the SSO requirement in the series' registration settings; the individual eWebinars inherit it.

Set up SSO for your team

eWebinar's SSO integration uses OpenID Connect (OIDC), not SAML, and requires the Enterprise plan. Your identity provider must support OpenID Connect; Okta, Azure Active Directory (Microsoft Entra ID), Google Workspace, Auth0, and most modern enterprise IdPs do. Setup happens once at the team level; afterwards you can require SSO on individual eWebinars as described above.

What you will need from your IT team

• OpenID issuer URL: the base URL of your OpenID provider (for example https://yourcompany.okta.com). eWebinar discovers the rest of the configuration from its /.well-known/openid-configuration endpoint.
• Client ID: the identifier your IdP assigned to the eWebinar application.
• Client secret: the secret used to verify token requests.

In return, eWebinar gives you a Login redirect URL (shown in eWebinar's SSO settings) that IT needs when creating the application in your IdP.

Setup steps

1. Ask IT to create an OpenID application for eWebinar in your identity provider.
2. Give IT the Login redirect URL shown under Integrations → SSO in your team settings so they can configure the callback.
3. Paste the OpenID issuer URL, Client ID, and Client secret into eWebinar.
4. (Optional) If your IdP authenticates users from several domains and you only want one, enter it in Restrict accounts to only one domain.
5. Click Connect and sign in with a valid employee account to confirm the integration works.

Return sites

On the SSO card, open Return sites to list the websites attendees (and dashboard OAuth) may return to after signing in. The list starts with the website host your team gave at signup (without www), and each site also covers its subdomains (for example acme.com covers learn.acme.com). Custom domains from the Custom domain add-on and sites where you embed widgets are shown as a read-only list from your domain settings and always count. Add any other landing or marketing hosts you use so people come back to those pages after SSO.

---