Google reCAPTCHA v3 can help reduce automated form submissions, fake enquiries and other types of website abuse. It works in the background and produces a risk score, so genuine visitors are not normally asked to tick a box or complete an image challenge.
To connect reCAPTCHA v3 to a WordPress plugin or another third-party integration, you will usually need a site key and a secret key. Google now manages reCAPTCHA through Google Cloud, so finding both keys involves a few more steps than it once did.
This guide explains how to register your website, create a score-based reCAPTCHA v3 key and securely retrieve the legacy secret required by many WordPress integrations.
Jump To:
- What Is Google reCAPTCHA v3?
- Before Creating Your Keys
- How To Create reCAPTCHA v3 Keys
- How To Find The Secret Key
- How To Share Your Keys Securely
- What Happens After Installation?
- Privacy And Cookie Considerations
- Common reCAPTCHA v3 Questions
- Help With reCAPTCHA v3
What Is Google reCAPTCHA v3?
Google reCAPTCHA is a system designed to help websites assess whether an interaction is likely to be legitimate or automated.
Version 3 uses score-based verification. It assesses signals connected with an interaction and returns a score from 0.0 to 1.0. A higher score indicates that the interaction is more likely to be legitimate, while a lower score suggests a greater risk of automated or abusive activity.
The website can then decide how to respond. Depending on the integration and score, it might:
- Allow the form submission
- Send the submission for additional checks
- Request another form of verification
- Flag the interaction for review
- Reject a suspicious request
A score is an assessment rather than proof that somebody is human or a bot. Genuine users can receive low scores, while some automated activity may receive higher ones. reCAPTCHA should therefore form part of a wider spam-prevention approach rather than being treated as complete protection by itself.
Before Creating Your Keys
You will need a Google account and access to the website’s domain details. If possible, create and manage the keys using an account owned by the business rather than a developer’s personal account.
This makes it easier for the business to retain access if its website provider changes in the future.
Google recommends creating separate keys for production and testing environments. Using live keys on a development website can affect the traffic information and risk analysis associated with the production website.
Before starting, confirm:
- The main website domain
- Whether a separate staging domain needs its own key
- Which Google account should own the key
- Whether the website integration requires a site key and secret key
How To Create Google reCAPTCHA v3 Keys
Step 1: Open The reCAPTCHA Admin Console
Visit the Google reCAPTCHA Admin Console and sign in with the Google account that should own and manage the website’s keys.
If keys have previously been created through that account, the existing websites will appear within the console.
Step 2: Register A New Website
Create a new registration and complete the requested information.
- Label: Enter a recognisable name, such as the business or website name.
- reCAPTCHA type: Select Score based (v3).
- Domain: Enter the domain, such as athenamedia.co.uk.
- Terms: Read and accept the relevant Google Cloud terms where required.
Enter the domain name without https://, a page path, query string or port number. Registering the main domain will normally include its subdomains, although a separate key is still recommended for a staging environment.
Step 3: Submit The Registration
Review the information and select Submit.
If this is your first time using the current reCAPTCHA system, Google may automatically create a Google Cloud project and enable the services required to manage the key.
The wording and layout of the Google interface may change, but the key should appear in the reCAPTCHA section of the associated Google Cloud project.
Step 4: Copy The Site Key
Open the reCAPTCHA area within Google Cloud and select the Keys tab. Find the key you have just created and open its details.
The Key ID displayed by Google Cloud is the site key. This is the public key used by the website’s front-end integration.
The site key is designed to be visible within website code, but it should still be restricted to the correct domain through the key settings.
How To Find The reCAPTCHA Secret Key
Many WordPress plugins still ask for a site key and secret key. Google refers to this as a legacy integration because newer custom integrations can use the Google Cloud assessment system instead.
To retrieve the secret key for a third-party plugin:
- Open the reCAPTCHA section of the relevant Google Cloud project.
- Select the Keys tab.
- Choose the required website key.
- Open the Integration tab.
- Select Integrate with a third-party service or plugin or Use Legacy Key, depending on the option shown.
- Copy the secret key from the dialog.
The site key may be public, but the secret key must remain private. It allows the website’s server or third-party integration to communicate with Google when verifying a reCAPTCHA response.
Never place the secret key in publicly visible website code. If you believe it has been exposed, replace it and update the website integration.
How To Share Your Keys Securely
If a developer or website support provider is installing reCAPTCHA for you, they may need both the site key and secret key.
Use a secure client portal, password manager or another agreed private method to share the secret. Avoid placing it in a public support ticket, shared document or message that can be accessed by people who do not need it.
Only provide the secret key to somebody you trust to manage the website. The site key and secret key should also be labelled clearly so they are not accidentally entered into the wrong fields.
What Happens After Installation?
Creating the keys does not protect the website by itself. They must be added to a compatible plugin or properly integrated into the website.
A complete implementation needs to:
- Request a reCAPTCHA token for the relevant interaction
- Verify that token on the server
- Check that the token is valid and intended for the expected action
- Review the returned risk score
- Decide how suspicious requests should be handled
The appropriate threshold will vary between websites and actions. A contact form may need a different response from a login attempt or account registration.
Google’s older v3 guidance suggests 0.5 as an initial threshold, but this should not be accepted blindly. Review the website’s own results and adjust the integration according to the amount of spam, the type of action and the risk of blocking genuine visitors.
Where possible, avoid relying on a single hard cut-off. A lower score could trigger additional checks, rate limiting or manual review instead of immediately discarding a potentially genuine enquiry.
After installation, submit test forms from different devices and connections. Check that genuine messages arrive correctly and that the website records or reports any reCAPTCHA errors.
Privacy And Cookie Considerations
Using reCAPTCHA does not automatically make a website compliant or non-compliant with UK data protection requirements. The outcome depends on how the service is implemented, what information is processed and how visitors are informed.
Google states that reCAPTCHA uses a cookie called _GRECAPTCHA when it performs its risk analysis. It may also process information about how visitors interact with the website.
Website owners should:
- Explain the use of reCAPTCHA within their privacy information
- Review Google’s current privacy terms
- Consider how reCAPTCHA cookies are categorised
- Check whether the implementation interacts correctly with the cookie consent system
- Make sure any notices accurately reflect what happens on the website
Cookie and privacy requirements can depend on the implementation and the circumstances of the organisation. Obtain appropriate advice if you are unsure about the lawful basis, consent requirements or information that should be provided to visitors.
Common Questions About Google reCAPTCHA v3
Can reCAPTCHA v3 Block Genuine Users?
Yes, genuine visitors can receive a low score. This is why thresholds and actions need to be monitored rather than assuming every low-scoring request is definitely spam.
Where an enquiry is valuable, consider using additional verification or review instead of silently deleting every low-scoring submission.
Does reCAPTCHA v3 Stop All Spam?
No spam-prevention system can promise to stop every unwanted submission. Some automated activity may receive a sufficiently high score, while determined attackers can change their methods.
reCAPTCHA can be combined with server-side validation, rate limiting, honeypot fields and sensible form design. If spam begins increasing again, review the complete form setup rather than only changing the score threshold.
Why Choose reCAPTCHA v3 Instead Of A Checkbox?
Score-based reCAPTCHA normally works without asking the visitor to complete a challenge. This can reduce interruptions when somebody submits a form.
However, version 3 is not automatically the right choice for every website. The decision should consider the type of action being protected, the available integration and how suspicious activity will be handled.
Does reCAPTCHA v3 Affect Website Performance?
reCAPTCHA loads external scripts and makes requests to Google, so it is not accurate to say that it has no performance cost. The impact will vary according to the implementation and where the script is loaded.
Test performance before and after installation, particularly on mobile devices. The script should be added only where it is genuinely needed or implemented according to the chosen integration’s current guidance.
Does reCAPTCHA v3 Affect SEO?
Using reCAPTCHA does not create an automatic search ranking penalty. However, any third-party script can affect loading performance or cause usability problems if it is implemented poorly.
Check that protected forms still work, page content remains accessible and visitors are not prevented from completing important actions.
Where Is reCAPTCHA v3 Most Useful?
Score-based protection can be considered for:
- Contact and quotation forms
- Login attempts
- Account registrations
- Password reset requests
- Newsletter sign-ups
- Comments and user-submitted content
Each action should be assessed separately. A website does not necessarily need identical settings for every form.
Is reCAPTCHA v3 Free?
Google offers different reCAPTCHA tiers, assessment allowances and pricing. These can change, so check the current Google Cloud reCAPTCHA pricing and expected number of assessments before choosing a setup.
Help With Google reCAPTCHA v3
Creating the keys is only the first part of protecting a website form. The keys still need to be installed correctly, verified on the server and tested to make sure genuine submissions continue to arrive.
Athena Media provides WordPress website maintenance and support, including help with website forms and spam-prevention measures.
If you need help creating, installing or checking your reCAPTCHA v3 integration, contact Athena Media to discuss the website and the forms you want to protect.
