Google reCAPTCHA

Google reCAPTCHA is a freemium WP PowerSuite security module that adds Google’s bot protection to WordPress and WooCommerce using either a v2 checkbox or v3 invisible scoring.

Create keys in the Google reCAPTCHA admin console, choose the matching version in WP PowerSuite, and enable the forms you want protected. Product overview: Google reCAPTCHA.

Block spam signups without another captcha plugin

Core WordPress and WooCommerce coverage is free. Unlock form integrations and skip rules with WP PowerSuite Pro.

View pricing

Why teams choose it

Google reCAPTCHA is still the default captcha many clients expect. Inside WP PowerSuite you get:

• Explicit v2 or v3 support with a configurable score threshold
• Free coverage for WordPress core and WooCommerce
• Pro coverage for the form stack agencies already use
• Server-side siteverify with action matching and token memoization
• One modular suite instead of yet another single-purpose plugin

Who it is for

• Sites that already standardize on Google reCAPTCHA keys
• Stores and membership sites fighting spam registrations
• Teams that want an invisible v3 score gate on high-traffic forms
• Agencies that need the same protection pattern as Turnstile, with Google as the provider

What it does

Free — WordPress core

Protect any combination of:

• Login — wp-login.php and custom login URLs
• Registration
• Password reset — lost-password request and set-new-password
• Comments — with a clear error redirect when verification fails

Magic Login screens are skipped so passwordless flows are not interrupted.

Free — WooCommerce

• Login, registration, and lost password
• Checkout — classic shortcode checkout and block checkout (Store API)
• Product reviews (when Comments protection is off)
• Express / wallet payments (Apple Pay, Google Pay, Link) are skipped
• HPOS and cart/checkout Blocks compatibility declared

Pro — form integrations (auto-inject)

When the matching plugin is active and the integration is enabled:

• Basic Forms (WP PowerSuite)
• Contact Form 7
• WPForms
• Formidable Forms
• Fluent Forms
• Elementor Pro Forms (including popups)
• Gravity Forms (final page only on multi-page forms)
• Jetpack forms
• bbPress (topics and replies)
• BuddyPress registration
• Ultimate Member (login, register, reset)
• MemberPress (login and checkout)
• Easy Digital Downloads (login, register, checkout)
• Paid Memberships Pro (checkout, frontend login, lost password, reset password)

Pro — MC4WP (shortcode only)

Mailchimp for WordPress does not auto-inject a widget. After you enable the MC4WP integration:

1. Open MC4WP → Forms and edit your form.
2. Place this shortcode above the submit button:

[wpps-mc4wp-recaptcha]

3. Save the form and hard-refresh the front end.

Verification runs only when that shortcode is present in the form.

Version model: v2 vs v3

	v2 (checkbox)	v3 (invisible)
Visitor UX	Checkbox / challenge when needed	No checkbox; risk score in the background
Theme	Light or Dark	Not applicable
Pass rule	Valid token from Google	Score ≥ threshold and matching action
Default threshold	—	0.5 (0.0–1.0)
Disable submit until solved	Supported (Pro)	Not used — token is obtained on submit

Key type must match

Create v2 keys for checkbox mode and v3 keys for score mode. Mixing key types with the wrong version setting is the most common setup failure.

This module does not expose a separate “v2 Invisible” setting — choose checkbox v2 or score-based v3.

Widget & API settings

Option	What it controls
Site Key / Secret Key	Google credentials. Secret is stored encrypted and never shown in cleartext.
reCAPTCHA version	v2 (checkbox) or v3 (invisible, score-based)
Theme	Light or Dark (v2 only)
Score threshold (v3)	Minimum Google score required to pass (default 0.5)
Widget language	Optional hl language code (Pro)
Disable submit until solved	Locks submit until v2 succeeds (Pro; v2 only)
Test connection	Obtains a token and verifies it with Google siteverify

Scripts load with Rocket Loader protection and common optimizer exclusions. Network/siteverify failures fail closed with a clear temporary-unavailable message (there is no Turnstile-style allow/failsafe mode in this module).

Advanced options (Pro)

• AJAX comment reset — reset the widget when replying to comments via AJAX
• Canonical-only login / registration — protect only the real wp-login.php paths
• WooCommerce checkout: guests only — skip logged-in shoppers
• Performance compatibility — keep reCAPTCHA out of major JS optimizers
• Resource hints — dns-prefetch / preconnect to Google / gstatic
• Blocksy compatibility — reset widgets in the Blocksy account modal

Skip rules (Pro)

Skip both the widget and verification for trusted traffic:

• WordPress roles
• IP addresses / CIDR ranges (IPv4 and IPv6)
• User-Agent substrings

Free vs Pro at a glance

Capability	Free	Pro
API keys, v2/v3, theme, score threshold	✅	✅
WordPress login, register, reset, comments	✅	✅
WooCommerce login, register, reset, checkout, reviews	✅	✅
Form-plugin integrations	—	✅
MC4WP shortcode	—	✅
Skip rules / optimizer & theme extras	—	✅
Disable submit / AJAX comment reset / guest-only checkout	—	✅

Without WP PowerSuite Pro, Pro-tier toggles are forced off at runtime even if they still appear saved. Install WP PowerSuite Pro and activate under WP PowerSuite → License.

Turnstile vs reCAPTCHA (quick chooser)

	Cloudflare Turnstile	Google reCAPTCHA
Provider	Cloudflare	Google
Default UX	Interaction-only	v2 checkbox or v3 score
Failsafe if API down	Pro allow / reCAPTCHA fallback	Fails closed
MC4WP shortcode	[wpps-mc4wp-turnstile]	[wpps-mc4wp-recaptcha]
Best when	You want quieter Cloudflare UX	You already standardize on Google keys

See also: Cloudflare Turnstile.

When to enable it

Turn it on when you want to:

• Use Google reCAPTCHA keys you already manage
• Choose an explicit checkbox (v2) or invisible score gate (v3)
• Cover classic and block checkout in one module
• Match the same integration surface as Turnstile under one suite

When to leave it off

Caution

Leave Google reCAPTCHA inactive if:

• You cannot load Google scripts (policy or regional restrictions)
• Cloudflare Turnstile or Simple CAPTCHA already covers the same forms
• You need a fully self-hosted challenge with no third-party calls — use Simple CAPTCHA

One challenge per form

Do not enable the same form in both reCAPTCHA and Turnstile. Overlapping challenges confuse shoppers and inflate support tickets.

How to get started

1. Create keys in the Google reCAPTCHA admin console for v2 Checkbox or v3.
2. Go to WP PowerSuite → Modules → Security and enable Google reCAPTCHA.
3. Open module settings → API & appearance, paste keys, select the matching version, set theme (v2) or score threshold (v3), and save.
4. Click Run test until the connection test succeeds.
5. Enable WordPress core and WooCommerce surfaces you need.
6. With a WP PowerSuite Pro, enable form integrations. For MC4WP, also add [wpps-mc4wp-recaptcha] in the form editor.
7. Hard-refresh protected pages (and purge page cache if you use one).

Multisite

If site-level keys are empty, the module can fall back to network options wpps_network_google-recaptcha_site_key and wpps_network_google-recaptcha_secret_key.

Tuning v3

If real visitors are blocked:

1. Lower the score threshold slightly (for example 0.5 → 0.3) and retest.
2. Confirm the domain is allowed in the Google console.
3. Confirm no optimizer is delaying api.js.
4. Prefer v2 checkbox on critical commerce flows if score false-positives continue.

How to verify it works

• Save keys and pass Run test.
  ✅ Siteverify succeeds for the selected version.
• Enable Login in a private window.
  ✅ v2 shows a checkbox; v3 stays invisible; failed verification blocks login.
• Place a test order on classic and block checkout.
  ✅ Verification is required for normal checkout; wallet/express paths still complete.
• Enable a Pro form integration and submit without completing reCAPTCHA.
  ✅ The form is rejected.
• For MC4WP, confirm the shortcode renders a widget (not literal text), then submit without solving.
  ✅ Subscription is rejected with the reCAPTCHA error message.
• For Paid Memberships Pro, open checkout, login, and lost-password pages.
  ✅ Widgets appear; checkout does not show an error before you submit.

Troubleshooting

• Invalid site key / version mismatch. v2 keys with v3 selected (or the reverse). Recreate keys for the version you selected.
• Always fails. Wrong secret, domain not in Google console, or score threshold too high for v3.
• Checkout fails for guests only. Check the checkout toggle and Pro guests only setting.
• MC4WP shows [wpps-mc4wp-recaptcha] as text. Enable the MC4WP integration with a valid WP PowerSuite Pro, keep the shortcode in the form editor, save, and hard-refresh.
• PMP error before submit. Update the module; validation belongs on submit, not page load.
• Two CAPTCHAs on one form. Disable the overlapping toggle in Cloudflare Turnstile or Simple CAPTCHA.
• Pro section locked or ignored. Install WP PowerSuite Pro and activate under WP PowerSuite → License, then re-save settings.

Manage with WP-CLI

Prefer the command line? You can turn this module on or off with WP-CLI instead of the dashboard:

# Turn the module on
wp powersuite module enable google-recaptcha

# Turn the module off
wp powersuite module disable google-recaptcha

# Check whether it is on, its category, and where its settings live
wp powersuite module get google-recaptcha

Managing more than one site? Add --url=https://example.com to point a command at one site. If this is a Pro module, install WP PowerSuite Pro and activate your license first. New to WP-CLI? See the full command guide.

FAQ

What does Google reCAPTCHA do in WP PowerSuite?

It adds Google reCAPTCHA v2 or v3 verification to WordPress core forms, WooCommerce surfaces, and Pro form-plugin integrations after you save site and secret keys.

Is Google reCAPTCHA free in WP PowerSuite?

Yes. Core WordPress and WooCommerce protection is free. Form integrations, advanced options, and skip rules require an active WP PowerSuite Pro license.

What is the difference between reCAPTCHA v2 and v3?

v2 shows a checkbox challenge. v3 is invisible and accepts or rejects based on a risk score threshold and matching action.

Does it protect WooCommerce Blocks checkout?

Yes. Classic checkout and block checkout (including Store API) are supported. Wallet/express payments such as Apple Pay, Google Pay, and Link are skipped.

How do I add reCAPTCHA to MC4WP forms?

Enable the MC4WP integration (Pro), then place [wpps-mc4wp-recaptcha] in the MC4WP form editor above the submit button. There is no auto-injection.

How do I fix v3 blocking real visitors?

Lower the score threshold, confirm the domain and key type, exclude reCAPTCHA from JS optimizers, or switch critical flows to v2 checkbox.

Can I use reCAPTCHA and Cloudflare Turnstile together?

You can enable both modules, but do not protect the same form in both. Overlapping challenges create a poor checkout or login experience.

How do I turn Google reCAPTCHA off?

Go to WP PowerSuite → Modules, find Google reCAPTCHA, and toggle it off. Disabled modules do not load at runtime.

Developer notes (hooks & filters)

Source: modules/google-recaptcha/module.php, ExtendedIntegrations.php, FeatureGate.php.
Boot: critical · context: both.

• Verify filter: wpps_verify_google_recaptcha
• Error copy filter: wpps_captcha_error_message
• Hostname allowlist: wp_powersuite_recaptcha_allowed_hostnames
• Woo Store API namespace: wp-powersuite-recaptcha (extension field token)
• Blocks mount: render_block_woocommerce/checkout-actions-block + assets/woo-checkout.js
• MC4WP shortcode: wpps-mc4wp-recaptcha (expanded via mc4wp_form_content + do_shortcode)
• v3 uses global submit interception to execute, inject the token, then continue submit for AJAX-aware forms
• Siteverify memoizes per request so single-use tokens survive WordPress double-validation paths

Related modules

• Cloudflare Turnstile
• Simple CAPTCHA
• Limit Login Attempts
• Two-Factor Authentication
• Block Usernames
• Basic Forms

Ready to stop spam at the form?

Enable Google reCAPTCHA in WP PowerSuite, pick v2 or v3, and protect only the surfaces you need.

Get WP PowerSuite