Spam form submissions can quickly become a nuisance on a WordPress website, particularly when your site uses forms for contact requests, inquiries, registrations, or other user submissions. Google reCAPTCHA helps distinguish genuine visitors from automated bots and is a useful addition to your website’s spam protection.
Read our article to find out how to set up Google reCAPTCHA, and how to add it to your WordPress website via a forms plugin like Gravity Forms.
What is reCAPTCHA?
Google reCAPTCHA is a security service that helps protect websites from spam and automated bots. It checks whether activity on your website is likely to be coming from a real person rather than an automated program submitting forms. Depending on the version you use, this may involve a simple checkbox or may happen behind the scenes without requiring any action from the visitor. Adding reCAPTCHA to your WordPress forms can help reduce unwanted submissions while allowing genuine visitors to use your forms normally.
How to set up Google reCAPTCHA
Step 1: Create the Google reCAPTCHA Keys
Go to the Google reCAPTCHA Admin Console and sign in with your Google account*. Our clients often use the same address as they used to set up Google Analytics.
*If you don’t have a Google account associated with your website, you can either sign up for one or try following these instructions.
Create a new label (typically the site name) and enter your website’s domain (remember to add the live site domain, not the development site if you are in a beta review phase). You’ll need to choose which version of reCAPTCHA you want to use.
Gravity Forms integrates with three types of Google reCAPTCHA.
- reCAPTCHA v3 – Adds a script to every page of your site and uploads form content for processing by Google. All submissions are accepted and suspicious submissions are marked as spam. When reCAPTCHA v3 is configured, it is enabled automatically on all forms by default. It can be disabled for specific forms in the form settings.
- reCAPTCHA v2 (Invisible) – Displays a badge on your form and will present a challenge to the user if the activity is suspicious e.g. select the traffic lights. Please note, only v2 keys are supported and checkbox keys are not compatible with invisible reCAPTCHA. To activate reCAPTCHA v2 on your form, simply add the CAPTCHA field in the form editor.
- reCAPTCHA v2 (Checkbox) – Requires a user to click a checkbox to indicate that they are not a robot and displays a challenge if the activity is suspicious.
Step 2: Make a Note of the Google reCAPTCHA Keys
Once your site is registered, Google will provide the credentials you need. If you have selected v2, you will be provided with a Site Key and Secret Key. Keep these somewhere secure—you’ll need them when configuring Gravity Forms.
If you are in a beta site review phase and your website developer has asked for the keys, you can just send both keys to them and they will do the rest!
How to Add reCAPTCHA to Gravity Forms
Step 1: Configure reCAPTCHA in Gravity Forms
Now that you have set up Google reCAPTCHA, log in to your WordPress dashboard and go to:
Forms → Settings → reCAPTCHA
Note: The built-in reCAPTCHA integration in Gravity Forms Core is being deprecated. To enable this function within Gravity, go to the Add-Ons menu and then install and activate the reCAPTCHA Add-On.
The exact options you see will depend on which reCAPTCHA integration you’re using. For v2, you’ll enter your Site Key and Secret Key into the appropriate fields, then select either the invisible or checkbox option. Gravity Forms will validate the keys when they’re entered.
If you’re using reCAPTCHA v3, you generally don’t need to add a CAPTCHA field to each individual form. Gravity Forms works in the background, assigning submissions a score based on Google’s assessment. Lower scores indicate a greater likelihood that the interaction is automated, and Gravity Forms can use a configured threshold to identify submissions as spam.
Step 2: Add reCAPTCHA to your Forms
This is where the process differs depending on the reCAPTCHA version you’ve chosen.
With reCAPTCHA v3, once the integration is correctly configured, it is automatically enabled on your Gravity Forms. You don’t need to drag a CAPTCHA field onto every form.
Note: reCAPTCHA v3 will add the logo to the lower right hand corner of every web page unless you confirm in the settings that Google’s Terms of Service and Policies have been added somewhere on the site. This is NOT required if you use v2.
If you’re using reCAPTCHA v2, Gravity Forms provides a CAPTCHA field that can be added through the form editor. Simply edit your form, find the CAPTCHA or reCAPTCHA field under the available fields, and add it where you want it displayed (usually as the very last field).
Step 3: Test Your Forms
If your site is live, test your form from the front end of your website. Submit a genuine test entry and make sure it reaches the expected destination.
It’s also worth checking your Gravity Forms entries for the reCAPTCHA score or spam status. If legitimate submissions are being flagged, you may need to review the threshold settings within the reCAPTCHA menu.
Final Thoughts
reCAPTCHA is one part of a broader spam-prevention strategy. Keeping WordPress, Gravity Forms, and other plugins up to date, while using appropriate security and spam-protection measures, can help keep your forms—and your website—secure.
If you have set up Google reCAPTCHA and need further help, please contact AndiSites. We can also help you with Gravity form integration, keeping your WordPress website secure, and other Google tools!