Spam bots never sleep. If your WordPress site has a contact form, a login page, or open comments, bots will find it — and soon your inbox fills with junk and your login page gets hammered with brute-force attempts. Learning how to add Google reCAPTCHA to WordPress is one of the fastest ways to stop that, and it takes fifteen minutes once you know which version to pick and where the keys go.
This guide covers the current way: creating keys in Google Cloud, wiring them into Contact Form 7 or WPForms, and protecting login, registration, and comments. No code required.
What Is Google reCAPTCHA (and Which Version Do You Need?)
Google reCAPTCHA is a free service that tells humans and bots apart before a form submission reaches your site. When you add Google reCAPTCHA to WordPress, you register your domain with Google, get two keys, and paste them into a WordPress plugin. Google does the risk analysis; your plugin acts on the result.
There are three flavors, and picking the wrong one is the most common mistake:
reCAPTCHA v2 Checkbox (“I’m not a robot”)
The familiar checkbox. Visitors click it, and suspicious traffic gets a picture challenge. It is visible and slightly annoying, but it clearly signals that a form is protected — a good choice for a contact form where trust matters.
reCAPTCHA v2 Invisible
Works like v2 but runs in the background, showing a challenge only when Google is suspicious. The only visible trace is a small badge in the bottom-right corner. A solid middle ground for most small business sites.
reCAPTCHA v3 (Score-Based)
Never shows a challenge at all. It runs silently on every page load and returns a score from 0.0 (likely a bot) to 1.0 (likely a human). Your plugin acts on that score using a threshold — 0.5 is Google’s standard default. This is the smoothest experience for real visitors.
One thing to know before you start: the key type is fixed when you create it. A plugin configured for v2 will not accept a v3 key, and vice versa. Decide first, then create the matching key.
What Changed in 2026: Keys Now Live in Google Cloud
If you followed an older tutorial, you may remember the standalone reCAPTCHA admin page. That page is gone as the place to create keys. Google moved key management into the Google Cloud console at the end of 2025, and from early 2026 new keys are created and managed only under a Google Cloud project. Existing classic keys were migrated automatically and keep working.
The free tier still covers most sites: 10,000 assessments per month. Google’s own migration guide is at docs.cloud.google.com/recaptcha/docs/migrate-recaptcha.
Step 1: Create Your reCAPTCHA Keys in Google Cloud
- Go to the Google Cloud console reCAPTCHA page and sign in. If you do not have a Cloud project yet, create one — it takes a minute.
- Click Create key and label it with your domain name.
- Choose the key type. For v3, select Score-based (no challenge). For a checkbox, select Challenge (v2) and then the “I’m not a robot” option.
- Add your domain exactly as visitors reach it, for example
example.com— nohttps://, no trailing slash. Add both www and non-www versions if you use both. Keys will not work on unlisted domains or on a local development site. - Click Create key. Google shows you two values: a site key (public, used in your front-end code) and a secret key (private, used server-side to verify responses).
- Copy both keys somewhere safe. Treat the secret key like a password — never paste it into a public forum, a screenshot, or a support ticket.
Step 2: Add reCAPTCHA to Your Contact Form
WordPress core has no built-in CAPTCHA, so to add Google reCAPTCHA to WordPress forms, the keys go into your form plugin. The process is the same everywhere: choose the version that matches your key, paste both keys, and enable protection on the forms you want guarded.
Contact Form 7
Contact Form 7 only supports reCAPTCHA v3, so create a v3 key in Step 1. In your dashboard, go to Contact > Integration > reCAPTCHA > Setup Integration, paste both keys, and save. That is the whole setup — every Contact Form 7 form on the site is protected, and a badge appears in the bottom-right corner of your pages.
WPForms
Go to WPForms > Settings > CAPTCHA, choose reCAPTCHA, pick the type that matches your key, paste both keys, and set the v3 score threshold. Then open each form you want to protect, go to Settings > Spam Protection and Security, and enable reCAPTCHA for that form. Unlike Contact Form 7, WPForms lets you protect forms one at a time.
If you have not built a form yet, start with my guide on how to add a contact form to WordPress. Gravity Forms and Fluent Forms follow the same pattern — paste the keys in the plugin’s reCAPTCHA settings and enable protection on the forms you want guarded.
Step 3: Protect Your Login Page, Registration, and Comments
Form plugins only protect their own forms. Your login page, registration page, and comments are separate surfaces — and wp-login.php is the target of most brute-force attempts. You have two options.
Option A: A Dedicated reCAPTCHA Plugin
Install Advanced Google reCAPTCHA from the WordPress plugin directory. Go to Settings > Advanced Google reCAPTCHA, select the version matching your key, and paste both keys. Then use the “Where to Show” tab to pick the surfaces it guards. One plugin, one set of keys, every surface covered.
If you run an online store, this step matters even more — checkout and account pages are prime bot targets. See my WooCommerce setup guide.
Option B: Use Your Security Plugin
If you already run Wordfence, you do not need another plugin. Go to Wordfence > Login Security, paste your reCAPTCHA v3 site key and secret key, and save. Wordfence then guards the login and registration pages with the same keys.
For a broader lockdown, work through my WordPress security hardening checklist — reCAPTCHA is one layer, and it works best alongside the rest.
Step 4: Test That reCAPTCHA Is Working
Test it the way a visitor would:
- Open your site in a private or incognito window so you are logged out.
- Visit a page with a protected form. For v3 and invisible v2, look for the reCAPTCHA badge in the bottom-right corner. No badge usually means the keys are not loading.
- Submit the form with a test message. It should go through normally. Then check the Google Cloud console’s reCAPTCHA analytics — you should see requests arriving and a spread of scores. No traffic at all means the keys are not firing.
Troubleshooting Common reCAPTCHA Errors
“ERROR for site owner: Invalid site key”
The site key does not match the domain or the key type. Check that the domain is registered exactly in Google Cloud, and that you pasted a v3 key into a v3 field (or v2 into v2). If forms fail silently instead, the secret key is wrong or the keys come from different pairs — re-copy both from the same key entry.
The Badge Shows, But Spam Keeps Coming
With v3, the score threshold may be too low, or the plugin may be set to log scores without blocking. Raise the threshold from 0.5 toward 0.7 and watch the results for a few days. Also confirm protection is enabled on the form receiving the spam — in WPForms, enabling the keys globally does not enable them per form.
Real Users Are Being Blocked
Lower the v3 threshold toward 0.3, and check whether a caching plugin is serving stale pages. A cached page can load the reCAPTCHA script with an expired token, which fails validation. Exclude form, login, and checkout pages from page caching.
reCAPTCHA v2 vs v3: Which Should You Choose?
For most WordPress sites, my recommendation is v3 with the default 0.5 threshold. It is invisible, it never interrupts a real visitor, and it catches the bulk of automated spam. Choose the v2 checkbox only when you want visitors to see that a form is protected — for example, a quote request form where trust matters — or when a client asks for it by name.
Once you add Google reCAPTCHA to WordPress, remember it is one layer of defence, not a complete security strategy. Pair it with strong passwords, two-factor authentication on admin accounts, and a security plugin that limits login attempts. Together, those layers make your site a much harder target than the unprotected WordPress sites bots scan every day.
If spam or a security worry is eating your time and you would rather have a developer handle it, get in touch — I help site owners with WordPress security, speed, and maintenance, and a reCAPTCHA setup is a quick win I can usually sort out in a single session.