Configure Google reCAPTCHA (v2 / v3) for WordPress & WooCommerce — logins, registrations, comments and checkout

Goal

This guide explains how to enable and configure Google reCAPTCHA (v2 or v3) on a WordPress site with WooCommerce to protect:

• the WordPress and WooCommerce login form;
• registration forms (WordPress and WooCommerce);
• the forgotten password form;
• blog comments;
• the checkout process (classic WooCommerce checkout, before order submission).

Prerequisites

1. Have a WordPress site with WooCommerce active (compatible version).
2. Have a Google reCAPTCHA account and the corresponding keys (site key and secret key) for your site domain(s).
3. Have administrator access to the WordPress back-office and to the Securantis plugin settings (CAPTCHA section).
4. For reCAPTCHA v3: verify that your forms can accept invisible tokens (g-recaptcha-response field). The Securantis module handles client-side generation and server-side verification.

Before you start, obtain your keys at https://www.google.com/recaptcha (choose v2 "I'm not a robot" or v3 according to your UX policy).

Configuration steps (step by step)

1. Open the Securantis administration interface > CAPTCHA section

   • Go to the CAPTCHA configuration page in the Securantis menu of your WordPress.

2. Choose the reCAPTCHA version

   • Select Google reCAPTCHA v2 (visible checkbox) or Google reCAPTCHA v3 (invisible, score-based) based on your preference.
   • Note: if you switch between v2 and v3, provide the corresponding Google keys; keys from an incompatible provider will temporarily disable protection until reconfiguration.

3. Enter the Google keys

   • Paste the site key (public) and the secret key (private). The secret key is stored encrypted.
   • Save the settings.

4. Enable protection on the desired forms

   • On the same page, select the contexts to protect: login, registration, forgotten password, comments and classic WooCommerce checkout.
   • For WooCommerce: explicitly enable payment form protection if you want to prevent automated submissions during order placement.

5. Choose the mode (protect / monitor)

   • "Protect" mode: submissions failing reCAPTCHA verification will be blocked server-side and the user will receive an error message.
   • "Monitor" mode: the system logs suspicious submissions without blocking the user — useful to assess impact before strict blocking.

6. Test in a non-production environment

   • Test on a staging site or in "monitor" mode before applying in production.
   • Test all forms: WordPress login, WooCommerce login, registration (WordPress and WooCommerce), comment and checkout. Verify the v2 widget displays and that the token is correctly populated for v3.

Expected outcome

• reCAPTCHA v2: a checkbox or visible widget appears on the selected forms; server-side verification validates the token before processing the submission.
• reCAPTCHA v3: no visible element (or a small status indicator), but a g-recaptcha-response token is automatically injected and verified server-side with the associated action (e.g. "login", "register", "checkout").
• In "protect" mode, submissions that fail verification are rejected and the user sees an appropriate error message.

Prudent settings and recommendations

• Initial mode: start in "monitor" mode for at least 48–72 hours to observe rejection rates and false positives before enabling blocking.
• reCAPTCHA v3: set an appropriate score threshold (e.g. 0.5 by default) and monitor real cases before lowering the threshold too much (risk of false positives).
• Multi-domains: register all domains and subdomains (front and back-office if separated) in the Google reCAPTCHA console to avoid provider errors.
• Cache / optimization: if your site uses aggressive caching or a CDN, ensure reCAPTCHA scripts and tokens are not cached in a way that returns expired tokens.

Common errors and explanations

• Widget missing on the form Possible cause: incorrect site key, v2/v3 key mismatch with the chosen type, or reCAPTCHA script blocked by a performance plugin or Content Security Policy. Action: verify the key, temporarily disable JavaScript/CSS optimization plugins and test.

• "secret key" missing or not configured error Cause: secret key empty or not saved. Action: enter the secret key in the configuration and save; server-side verification requires this key.

• High rejection rate in v3 (false positives) Cause: score threshold too strict, actions mis-mapped, or legitimate traffic with atypical behavior (e.g. mobile users, VPN). Action: switch to monitor mode, raise the threshold, analyze logs and adapt.

• Provider (Google) error or latency Cause: temporary unavailability of the Google API, affected server network, or exceeded call limits. Action: check Google reCAPTCHA status and error logs; in case of prolonged incidents, switch to monitor mode or temporarily disable protection if it blocks excessively.

Step-by-step troubleshooting

1. Check the Securantis plugin logs for messages related to reCAPTCHA (verification errors, provider errors, missing tokens).
2. Test server-side validation with a request tool reproducing the token if possible, or enable monitor mode to collect examples.
3. Temporarily disable minification/concatenation plugins and the theme "JS optimizer" then retest.
4. Ensure calls to Google APIs are not blocked by the firewall or the server's network configuration.
5. For WooCommerce checkout: verify compatibility with custom checkout plugins (e.g. multi-step checkout) — some custom flows require manual addition of the token field to the correct form.

Precautions

• Never ask for the secret key via public email; store it securely. Securantis support will never ask for your password.
• Quarantine, deletion or restoration decisions following a suspicious submission remain manual: reCAPTCHA does not perform automatic deletion.
• Before any change on the production site, back up the configuration and the database.

When to contact Securantis support

Contact support if:

• You observe massive rejections affecting legitimate users despite cautious settings.
• The Google API returns repeated errors (5xx, call limits) and you cannot identify a network cause.
• The widget does not display even though keys are correct and frontend optimizations are temporarily disabled.
• You need help integrating reCAPTCHA into a heavily customized WooCommerce checkout.

In your request, provide (without passwords or credentials):

• A precise description of the problem and screenshots of error messages;
• Context (type of reCAPTCHA chosen, monitor/protect mode, affected pages);
• Timestamps of problematic events and, if possible, examples of rejected tokens (if available in the logs).

Conclusion

The reCAPTCHA protection offered secures server-side the main critical interactions of your WordPress and WooCommerce site. Test in monitor mode, adjust thresholds for v3 and verify compatibility with frontend optimizations and checkout extensions. If in doubt, Securantis support can assist in analyzing logs and adjusting the configuration.