Setting Up reCAPTCHA v3 (and v2)PRO
This page teaches you how to add Google reCAPTCHA spam protection to your FormForge Pro forms. You’ll register your site with Google, enter the site key and secret key into FormForge, choose the reCAPTCHA version that fits your audience, and enable the protection on the forms that need it. The article also covers the troubleshooting playbook for the two most common errors: Invalid site key and Verification failed.
A Google account to register your site at the reCAPTCHA admin console, and administrator access to your WordPress site. Setup takes about 10 minutes end-to-end.
v2 vs v3: which should you pick?
FormForge supports both Google reCAPTCHA versions. You pick one in the Settings dropdown, and it applies to every form that has reCAPTCHA enabled. The two work very differently.
| Version | What the visitor sees | Best for | Watch out for |
|---|---|---|---|
| v2 | A visible “I’m not a robot” checkbox above the submit button. Occasionally a picture puzzle challenge. | Forms where you want visitors to see an explicit consent action, or as a fallback when v3 is causing legitimate submissions to fail. | Modern bots defeat v2 fairly easily now. Not recommended as your only defense. |
| v3 | Nothing at all. A small reCAPTCHA badge appears in the corner of the page, but there’s no interaction. | Public forms where you want zero friction for real visitors. Better bot detection than v2. | Because it’s invisible, legitimate users can be silently blocked if Google’s scoring model misjudges them. If you get real-user complaints, switch to v2 or Cloudflare Turnstile. |
Start with v3 for the best visitor experience. If you see real users report they can’t submit, or the reCAPTCHA badge is not acceptable in your site’s footer, switch to v2. If neither works well, try Cloudflare Turnstile (available as an alternative spam provider in FormForge Settings) which catches modern bots that reCAPTCHA v2 and v3 miss.
Step 1: Register your site with Google
Google issues a site key + secret key pair for each registered site. You’ll paste these into FormForge in Step 2.
Open the reCAPTCHA admin console
Go to google.com/recaptcha/admin and sign in with your Google account. Click the + (Register a new site) button at the top right.
Fill in the registration form
Give it a label (typically your domain name). Under reCAPTCHA type, choose reCAPTCHA v3 for invisible protection or reCAPTCHA v2 “I’m not a robot” Checkbox for the visible checkbox flow. You have to pick one; the key pair Google generates only works with the version you register.
Add your domain(s)
Under Domains, enter the domain your forms are on (for example, yourbrand.com). Do not include https:// and do not include a trailing slash. If your site is reachable at both www.yourbrand.com and yourbrand.com, add both as separate entries. If you use a staging site, add its domain too.
Accept the terms and submit
Check the “Accept the reCAPTCHA Terms of Service” box, then click Submit. Google displays your Site Key and Secret Key on the next screen. Copy both into a secure place. Keep this browser tab open while you switch to WordPress in Step 2.
Google will reject verification for any domain not listed in your reCAPTCHA registration. If your form is on www.yourbrand.com but you registered only yourbrand.com, every submission will fail with an Invalid domain for site key error. When in doubt, register both variants at Google.
Step 2: Enter the keys in FormForge Settings
Open FormForge Settings
In your WordPress admin, go to FormForge > Settings. Scroll down to the reCAPTCHA Settings section.
Pick the version
The reCAPTCHA Version dropdown offers v2 and v3. Choose the version that matches the type you registered with Google in Step 1. Registering as v3 and picking v2 in FormForge (or vice versa) will produce a validation failure on every submission.
Paste the site key and secret key
Paste your reCAPTCHA Site Key and reCAPTCHA Secret Key into their respective fields. Both come from Google’s admin console screen in Step 1.
Click Test reCAPTCHA Keys
FormForge exposes a Test reCAPTCHA Keys button right below the key fields. Click it. The button validates that the site key + secret key pair are actually recognized by Google. A green success message confirms the keys are ready; an error message means one of the keys is wrong or the pair does not match.
Save settings
Save the Settings page. Your keys are now stored globally and available to every form.
Step 3: Set reCAPTCHA as the active spam provider
FormForge supports three spam protection providers in parallel: reCAPTCHA, Cloudflare Turnstile, and honeypot-only. Only one is active at a time. This step tells FormForge to use the reCAPTCHA keys you just entered.
Still on FormForge > Settings, find the Spam Provider radio group
Just below the reCAPTCHA Settings section, look for the Spam Provider selector. Three options: Honeypot only (no CAPTCHA), Google reCAPTCHA (v2 or v3), and Cloudflare Turnstile (recommended).
Select Google reCAPTCHA
Click the Google reCAPTCHA (v2 or v3) radio button. This activates the reCAPTCHA keys you configured above.
Save settings
Save the Settings page. Every form that has reCAPTCHA enabled (Step 4) will now use these keys.
The honeypot is a hidden field that only bots fill in. It’s enabled globally by default and stays on even when reCAPTCHA is your primary spam provider. Together they catch different bot classes: honeypot catches naive form-scraping bots, reCAPTCHA v3 catches more sophisticated ones. Leave honeypot on unless it’s conflicting with your form.
Step 4: Enable reCAPTCHA on individual forms
Global settings prepare the keys; the actual reCAPTCHA widget only renders on forms where you explicitly turn it on. This lets you skip reCAPTCHA on internal admin forms while protecting public-facing ones.
Open the form in the builder
Go to FormForge > All Forms, click the form name to open it.
Open the General tab
In the form builder’s top navigation, click the General tab. Scroll down to the spam-protection section.
Check Enable reCAPTCHA
Tick the Enable reCAPTCHA checkbox. If reCAPTCHA is not yet configured globally (Step 2 not done), the checkbox has no effect on rendering; the widget only appears when both the per-form toggle AND the global site key are present.
Save the form
Click Save Form at the top right. The next front-end render of this form will include the reCAPTCHA widget (v2 checkbox) or invisible token collection (v3).
Step 5: Test a real submission
Load the form on the front end and submit it. The reCAPTCHA widget behavior differs by version, so what you see depends on which version you picked.
Open the page that has the form
In a browser (ideally an incognito/private window to avoid caching), open the page where your form is embedded.
v2: click the “I’m not a robot” checkbox
The reCAPTCHA widget appears above the submit button. Click the checkbox. Google may show a picture puzzle challenge; complete it. The checkbox turns to a green check when you pass.
v3: just fill in the form
No visible widget. A small reCAPTCHA badge appears in the lower-right corner of the page. Fill in your form fields as usual.
Submit
Click the submit button. FormForge sends the reCAPTCHA token to Google for verification along with the form data. If Google says the token is valid, the entry saves and you see the normal confirmation. If Google rejects it, you see a validation error and the entry is NOT saved.
Verify the entry landed
Go to FormForge > Entries and confirm your test submission is at the top of the list. If it’s there, the reCAPTCHA verification succeeded and the form saved normally.
Troubleshooting
“Invalid site key” or reCAPTCHA widget shows an error
The site key you pasted into FormForge does not match what Google issued for the domain the form is on. Check three things:
- Domain match: the domain in your reCAPTCHA registration matches the domain visitors see. If you registered
yourbrand.combut the form is onwww.yourbrand.com, register both variants in Google’s admin console. - Version match: you registered a v3 site but selected v2 in FormForge (or vice versa). Registration and FormForge Settings must both be the same version.
- Copy-paste hygiene: verify no leading or trailing whitespace on the key value.
“Verification failed” on every submission
The site key is correct but Google rejects the token when FormForge submits it. Common causes:
- Secret key mismatch: verify the Secret Key in FormForge matches the Secret Key from the same registration as the Site Key. If you regenerated keys in Google’s admin, update both in FormForge.
- Server can’t reach Google: FormForge POSTs to
www.google.com/recaptcha/api/siteverify. If your host blocks outbound HTTPS to Google, verification always fails. Contact your host to allow outbound requests togoogle.com. - Clock skew: reCAPTCHA tokens have a short lifetime. If your server’s system time is significantly wrong (more than a few minutes off), Google may reject tokens as expired. Fix your NTP setup.
reCAPTCHA v3 is on but bots are still getting through
FormForge’s v3 verification accepts any submission that Google marks as successful. Google’s v3 model can misclassify sophisticated bots as human. If v3 is not catching enough, try in this order:
- Switch to Cloudflare Turnstile as your Spam Provider in FormForge Settings. It catches modern bots more reliably than reCAPTCHA v3.
- Leave the honeypot enabled alongside (both can run simultaneously) so bots that defeat one still get caught by the other.
- If you have a specific bot pattern (same IP range, same field values), add a firewall rule at your host or use a plugin like Royal AI Firewall to block it upstream of WordPress entirely.
Real users report they can’t submit the form
v3 can silently block real users if Google’s scoring misclassifies them. Fastest fix:
- Switch FormForge > Settings > reCAPTCHA Version to v2. Regenerate a v2 key pair in Google’s admin console (a v3 site key does not work as v2), update FormForge with the new keys, and save. Real users can now pass the visible checkbox flow.
- Alternatively, temporarily uncheck Enable reCAPTCHA on the affected form while you investigate. Honeypot still catches naive bots in the meantime.
The reCAPTCHA badge is in the wrong corner or overlapping content
The badge is rendered by Google’s script and defaults to the lower-right corner. It cannot be repositioned from FormForge. Two workarounds:
- Add CSS to your theme that offsets or hides the badge (Google’s terms require you to include the text “This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.” somewhere on the page if you hide the badge).
- Switch to reCAPTCHA v2 or Cloudflare Turnstile, both of which render the widget inline within the form instead of as a floating page badge.
FAQ
What is the difference between reCAPTCHA v2 and v3?
v2 shows a visible checkbox that visitors must click before submitting. v3 runs invisibly in the background using Google’s risk scoring, so visitors never see anything. v3 is generally the better experience for most forms because it does not add a step to the submission flow. v2 is the safer fallback when v3’s invisible mode causes false-positive blocks or when your users prefer an explicit consent action.
Do I need both a site key and a secret key?
Yes. The site key is public and used by the frontend JavaScript to request a token from Google. The secret key stays server-side and is used by FormForge to verify the token with Google when the form is submitted. Both must be entered in FormForge > Settings > reCAPTCHA Settings. They come in a pair from the Google reCAPTCHA admin console.
Can I use one key pair for multiple sites?
Only if all sites share the same domain (or if you list every domain in the reCAPTCHA registration). Otherwise, register each site separately in Google’s admin and use per-site keys. Reusing a key pair across sites where the domain is not registered will fail with an Invalid site key error.
What happens if reCAPTCHA verification fails?
The form submission is rejected before the entry is saved. The visitor sees a validation error asking them to complete the reCAPTCHA (v2) or retry (v3). Nothing is written to FormForge > Entries. If real users report they cannot submit your form, verify reCAPTCHA is not misconfigured, or temporarily disable it on that form while you investigate.
Does FormForge support Cloudflare Turnstile?
Yes. Turnstile is one of the three spam provider options in FormForge > Settings (alongside Google reCAPTCHA and Honeypot only). Setup follows the same pattern: register your site with Cloudflare, paste the site key and secret key into FormForge, and pick Turnstile as the active provider. Turnstile has better bot detection than reCAPTCHA v3 for many modern bot classes and does not add a persistent badge to your page.
I set up reCAPTCHA but bots are still getting through. What’s wrong?
First confirm you are on reCAPTCHA v3, not v2 (v2 is trivially defeated by modern bots). Then confirm your site key is registered for the exact domain visitors see (including www vs non-www). If bots still get through, consider switching to Cloudflare Turnstile, which FormForge also supports as an alternative spam provider and which catches modern bots reCAPTCHA misses.
Does FormForge score-threshold v3 responses?
No. FormForge accepts any v3 submission that Google marks as successful, regardless of the score value Google returns. This keeps the verification path simple but means that if Google’s v3 model misjudges bot traffic, some bots may pass. Combining v3 with honeypot (both enabled) or switching to Cloudflare Turnstile addresses this for most sites.