How to Add reCAPTCHA to a WordPress Form

Get the version right first. Keys are version-specific: a v2 key pair in a v3 field fails every time, with no useful error. That single mismatch causes most "reCAPTCHA broke my form" reports.

v2 versus v3

v3 is more elegant and harder to support, because a legitimate visitor scoring below your threshold is refused with no explanation. If you use it, log rejected submissions somewhere so you can see what you are turning away.

Step 1: register the keys

1. Open the reCAPTCHA admin console and add a site.
2. Choose the version deliberately — v2 "I'm not a robot" checkbox, or v3.
3. Add every domain the form appears on: the live domain, www if used, and your staging domain.
4. Copy the site key and secret key.

localhost needs adding explicitly if you test locally. Domains are matched exactly, so a form on a subdomain needs that subdomain listed.

Step 2: add the keys in one place only

Most form plugins have their own reCAPTCHA settings. Use those, not a separate captcha plugin as well — two implementations on one page render two widgets and both fail.

• Contact Form 7 — under Contact → Integration, then add the [recaptcha] tag for v2, or rely on the automatic v3 integration.
• WPForms, Gravity Forms, Ninja Forms — a captcha field or setting per form, with keys stored globally.
• Elementor Pro forms — keys go under Elementor → Settings → Integrations, then add a reCAPTCHA field to the form.
• WooCommerce checkout and registration — handled by a dedicated plugin; core does not include it.

Save, then load the form logged out. The v2 widget should render; for v3 you should see the badge in the corner.

Step 3: test as a real visitor would

Testing while logged in, in the browser you built the site in, proves very little.

1. Open a private window on a different network — mobile data works well.
2. Submit the form with realistic content.
3. Confirm the notification email arrives.
4. Confirm the entry is stored in the plugin's submissions list.

That last point matters: enable submission storage before adding a captcha, so a lost notification does not mean a lost enquiry. The reasoning is in contact form not sending email.

Tuning v3

The default threshold of 0.5 is a starting point, not a recommendation.

• Lower it to 0.3 if legitimate submissions are being rejected — mobile users, VPN users and privacy-focused browsers all score lower.
• Raise it only if spam is getting through at the default.
• Log the score with each submission if the plugin supports it, then look at the distribution before changing anything.

Watch enquiry volume for a week after enabling. A silent drop in submissions is what a threshold set too high looks like from the business side.

Common problems

The caching cases are the ones people chase longest. Exclude form pages from full-page caching, and disable JavaScript combination for them — the risk list is in choosing a cache plugin.

Alternatives worth considering

• A honeypot field — a hidden input bots fill in and humans do not. Zero friction, catches a large share of automated spam, and costs nothing.
• A time check — reject submissions completed within a second or two of the page loading.
• A simple question relevant to your audience, which avoids sending visitor data to a third party.
• Server-side spam filtering, which scores submissions after the fact rather than blocking them up front.

Consider privacy as well: reCAPTCHA sends visitor data to a third party, which may need disclosure in your privacy policy and a mention in your consent banner — see cookie consent plugins.