Add a CAPTCHA (reCAPTCHA v2/v3) to customer accounts and PrestaShop forms without breaking the cart or orders

Goal of the article

This guide explains how to enable and configure the CAPTCHA provided by the Securantis module on PrestaShop (versions 1.7 to 9) to protect customer forms (registration, password reset, contact) without impacting the cart, the checkout page or order submission. It details the verifications, the steps to follow, cautious settings, common errors and troubleshooting procedures.

Prerequisites

• Securantis module installed and license activated on your PrestaShop store (1.7 → 9).
• Administrator access to the PrestaShop back office.
• Valid reCAPTCHA keys provided by Google (site key and secret key). You can use reCAPTCHA v2 (checkbox) or reCAPTCHA v3 (score-based).
• Recent backup of the store and a copy of the database (precaution before testing in production).

Principles applicable to PrestaShop

• The Securantis module offers reCAPTCHA integration in v2 or v3. If protection is disabled or the site key is empty, nothing is injected on the pages.
• Front-end rendering depends on the “context”: the module injects a marker indicating the form context (e.g. account creation, password reset). Behavior changes depending on whether the context is configured as protected or not.
• The module avoids printing the main reCAPTCHA script multiple times on the same page (internal mechanism to prevent duplicates).
• It is essential not to enable the CAPTCHA on cart / payment (checkout) forms: any modification of these pages can interrupt order submission or break AJAX tokens used by the theme or payment modules.

Recommended steps (progressive activation)

1. Verify reCAPTCHA keys

   • Retrieve your Google keys (site key and secret). Ensure your store domain is declared there.

2. Backup

   • Make a backup of files and the database, or perform these operations on a copy/staging environment.

3. Enable reCAPTCHA in Securantis (test mode)

   • In the Securantis back office, enable the reCAPTCHA feature but limit its application to non-critical forms (registration, password reset, contact).
   • Choose reCAPTCHA v3 first if you want silent, score-based protection, or v2 if you prefer the explicit checkbox.

4. Configure protected contexts

   • Enable CAPTCHA only for customer contexts: account creation, customer login (optional), password reset, contact forms.
   • Verify that the “cart” and “order” contexts are not selected. Never place CAPTCHA on the checkout page or on cart AJAX actions.

5. Observation / score mode (for v3)

   • For reCAPTCHA v3, start with a conservative score threshold (for example 0.5). Observe events and adjust progressively.

6. Test on staging then production

   • Test in a preproduction environment with multiple browsers and devices.
   • Test account creation, login, password reset, sending a message via the contact form.
   • Also verify add to cart, quantity modification, proceeding to checkout, and order validation (to ensure no script interacts with the checkout).

Expected result

• Protected forms display a reCAPTCHA element: checkbox (v2) or invisible token (v3). Legitimate submissions normally succeed.
• Cart/checkout pages remain unchanged and functional (AJAX and redirects not interrupted).
• reCAPTCHA events are logged by Securantis for analysis and threshold adjustment if necessary.

Cautious settings

• Activate first for a few contexts (registration and contact) and increase only if stable.
• For v3, do not lower the threshold below 0.3 without serious analysis: you risk allowing too much automated traffic.
• If you use a custom theme or a third-party checkout module, test thoroughly: some front-end scripts may depend on a specific order of script inclusion.

Common errors and symptoms

• CAPTCHA does not appear on a form

  • Site key is empty or misconfigured. Check the key in the Securantis configuration.
  • The page context is not recognized as enabled by the module.

• Form blocked or JavaScript error on the cart/checkout page

  • CAPTCHA has been applied to a checkout context: disable immediately for these pages.
  • Conflict with another reCAPTCHA script or multiple inclusion of the Google script; the module attempts to avoid duplicates, but a theme may force a second inclusion.

• False positives (v3): users blocked while legitimate

  • Score threshold too strict. Raise the threshold or switch to observation to collect data.

Step-by-step troubleshooting

1. Verify configuration

   • Ensure the reCAPTCHA option is enabled and that the site key is not empty.

2. Isolate the issue

   • Temporarily disable applying CAPTCHA to the affected forms to confirm the malfunction originates from there.

3. Consult the browser console

   • Look for JavaScript errors or warnings about inclusion of the reCAPTCHA script.

4. Test without third-party modules

   • If possible, temporarily switch to the default theme and disable checkout/optimization modules to identify a conflict.

5. Adjust v3 mode

   • If v3 blocks legitimate users, switch to observation mode (collect only) then gradually increase the threshold.

Additional precautions

• Never enable CAPTCHA on endpoints used by payment gateways or payment webhooks.
• Avoid activation on forms processed via AJAX if the theme does not refresh reCAPTCHA tokens correctly.
• Maintain a communication channel for customer feedback: if customers report order blockage, disable protection on checkout quickly before any investigation.

When to contact Securantis support

Contact support if:

• After checks, CAPTCHA still blocks legitimate orders or prevents critical actions.
• You observe persistent JavaScript errors that you cannot resolve by isolating themes/modules.
• You want an assisted review of the configuration on your store (paid intervention possible). In that case, never send passwords by email or chat. The access necessary for an intervention is provided only via the secure client area after agreement and payment.

Additional information

• Securantis does not automatically erase suspicious content: any quarantine, restoration or deletion requires a human decision.
• If you switch from v2 to v3 (or vice versa), retest all contexts and monitor event logs to avoid unexpected impacts.

Summary and quick best practices

• Enable reCAPTCHA progressively and only on non-critical contexts.
• Test on staging before production, monitor logs and user feedback.
• Do not modify checkout/payment forms: if they are custom-built, request assistance before applying a CAPTCHA.

If you need help verifying your protected contexts or interpreting Securantis logs, contact our support specifying the PrestaShop version, the theme used and the list of active payment/checkout modules.