reCAPTCHA
Three versions, two keys, and — for v3 — a score threshold you can tune when real visitors start being turned away.
- Intermediate
- 6 min read
- Applies to 2.0
Get your keys first
Have the keys before you switch it on. Switched on without them, reCAPTCHA closes the forms rather than letting submissions past: signing in, registering and password recovery are refused, each with a message saying verification is not finished being set up. The section says so in red.
Administrators are the exception, deliberately — otherwise the person who has to paste the keys would be locked out. It buys them nothing else: the password and every other check still apply.
Register your site with Google reCAPTCHA, choosing the version you want, and keep the site key and the secret key to hand.
Setting it up
User Access → Security → reCAPTCHA Integration.
The reCAPTCHA section: the switch, version, keys and the forms to protect.
- Turn reCAPTCHA Integration on.
- Pick the version — see below.
- Paste the site key and the secret key.
- Tick the forms to protect: Login, Registration, Lost Password. Leave them all unticked and all three are protected — the boxes narrow the scope, they are not what turns protection on.
- Save.
Which version
| Version | What the visitor sees |
|---|---|
| v2 Checkbox | the "I'm not a robot" tick box |
| v2 Invisible | nothing, unless Google is unsure and shows a challenge |
| v3 | nothing, ever — Google scores the visit silently |
v2 Checkbox is the safe choice: visitors understand it, and when it fails they know why. v3 is the least intrusive but needs a judgement call from you, which is the next section.
The v3 score threshold
v3 does not pass or fail a visitor. It returns a score between 0.0 — almost certainly a bot — and 1.0 — almost certainly a person. You decide where the line falls.
Score Threshold appears under the version dropdown once v3 is selected. Submissions scoring below it are refused.
| Threshold | Effect |
|---|---|
| 0.5 | Google's suggested starting point, and the default |
| higher, e.g. 0.7 | stricter — more bots stopped, more real people caught with them |
| lower, e.g. 0.3 | more permissive — fewer complaints, more spam gets through |
Start at 0.5 and only move it if you have a reason to. The symptom that calls for lowering it is real members reporting that a form refuses them for no apparent reason; the symptom that calls for raising it is spam registrations getting through.
The threshold only exists for v3. It is hidden for both v2 versions because they produce no score for it to compare against.
Coming from version 1.x? The threshold was fixed at 0.5 with no way to change it, and the field that was supposed to hold it was never read. If v3 was turning your visitors away and you could find nothing to adjust, this is why. It is adjustable in 2.0.
When it does not appear
- Both keys are needed. One alone leaves reCAPTCHA inactive, silently.
- The forms are opt-in. Only the ones you tick are protected.
- Choosing Strict mode turns reCAPTCHA on but cannot supply your keys — see Security modes. Enter them before relying on it.
- Turning it off keeps your keys. They are still there when you turn it back on.
Something missing or out of date? Tell support.