Opens in a new tab
Turquoise abstract wavy W logo on a black background
Turquoise abstract wavy W logo on a black background
White WP PowerSuite logo on a black background
White WP PowerSuite logo on a black background
[wpps_ai_summarize]
On This Page
Last updated: 04/08/2026

Google reCAPTCHA

Google reCAPTCHA on logins, forms, comments, and WooCommerce to block bots and spam signups.

Overview

Google reCAPTCHA protects WordPress logins, registrations, comments, WooCommerce checkouts, and supported third-party forms from spam and automated submissions.

Choose the familiar reCAPTCHA v2 checkbox or use invisible, score-based reCAPTCHA v3. Core WordPress and WooCommerce protection are available for free, while Premium adds third-party integrations, advanced skip rules, guest-only checkout protection, additional language and performance controls, and deeper handling for AJAX-powered forms.

Solid black square
Solid black square
Who is this for?
  • WordPress websites receiving spam registrations, comments, or login attempts
  • WooCommerce stores dealing with fake orders and automated checkout abuse
  • Websites using contact forms, membership forms, and frontend account systems
  • Site owners who prefer Google reCAPTCHA v2 or score-based v3 protection
  • Agencies protecting forms across multiple client websites
  • Developers working with AJAX forms, popups, WooCommerce Blocks, and dynamic interfaces

Features

reCAPTCHA v2 and v3
Choose between the visible reCAPTCHA v2 checkbox and the invisible, score-based reCAPTCHA v3 model.
WordPress Login Protection
Protect the standard WordPress login screen and supported custom login URLs from automated login attempts.
Registration and Password Reset Protection
Add reCAPTCHA verification to WordPress registration, lost-password, and new-password forms.
Comment Spam Protection
Protect WordPress comments from automated submissions while showing a clear error when verification fails.
WooCommerce Protection
Add reCAPTCHA to WooCommerce login, registration, password recovery, checkout, and product-review forms.
Classic and Block Checkout Support
Protect traditional WooCommerce checkout pages, WooCommerce Blocks, and Store API checkout requests.
Smart Skip Rules
Premium can bypass both the reCAPTCHA widget and verification for trusted roles, IP addresses, network ranges, or matching user agents.
Guest-Only Checkout Protection
Premium can require reCAPTCHA only for WooCommerce guests while allowing logged-in customers to complete checkout without it.
Multisite Support
Use site-specific credentials or inherit reCAPTCHA keys from the WordPress multisite network configuration

Protect Core WordPress Forms

  • The free version protects the main WordPress entry points commonly targeted by bots.
  • You can enable reCAPTCHA on login, registration, lost-password, password-reset, and comment forms.
  • Supported custom login URLs remain protected when the default WordPress login address has been changed.
  • The module also avoids supported Magic Login flows where adding another verification step could interfere with passwordless access.
  • Comment protection works for both guests and logged-in users. When verification fails, the visitor is returned with a clear notice instead of receiving an unexplained error.

Reduce WooCommerce Checkout Abuse

  • Automated checkout submissions can create fake orders, trigger unnecessary emails, fill customer records with invalid data, and place avoidable load on payment and shipping services.
  • Google reCAPTCHA can protect WooCommerce login, registration, lost-password, checkout, and product-review forms.
  • Protection works with both classic checkout and modern WooCommerce block checkout. Store API requests are also verified so bots cannot simply bypass the visible checkout form and submit directly to the API.
  • Premium users can restrict checkout protection to guests. Logged-in customers can continue through checkout without an additional CAPTCHA step while anonymous visitors remain protected.
  • Express payment methods are treated separately. Supported Apple Pay, Google Pay, Link, and wallet-based flows are skipped where normal CAPTCHA verification would prevent the payment from completing.

Works With Popular WordPress Plugins

  • Premium extends Google reCAPTCHA beyond WordPress and WooCommerce.
  • Supported form integrations include Basic Forms by WP PowerSuite, Contact Form 7, WPForms, Formidable Forms, Fluent Forms, Elementor Pro Forms, Gravity Forms, and Jetpack Forms.
  • Community and membership integrations include bbPress, BuddyPress, Ultimate Member, MemberPress, and Paid Memberships Pro.
  • Easy Digital Downloads login, registration, and checkout forms can also be protected.
  • Each integration is designed around the way the supported plugin works. Elementor popup forms can initialize correctly, Fluent Forms conversational flows are supported, and Gravity Forms applies verification on the final step of multi-page forms.
  • Mailchimp for WordPress uses an explicit shortcode rather than automatic injection. Add [wpps-mc4wp-recaptcha] inside the MC4WP form editor wherever the reCAPTCHA should appear.

Use Cases

  • Protect WordPress Login Forms
    Reduce automated login attempts on the default WordPress login page or a supported custom login URL.
  • Stop Spam Form Submissions
    Add reCAPTCHA to supported contact form plugins and block automated enquiries before they reach your inbox.
  • Reduce Fake WooCommerce Orders
    Protect classic checkout, block checkout, and Store API submissions from automated order creation.
  • Protect Guest Checkout Only
    Require reCAPTCHA for guest customers while allowing logged-in customers to complete checkout without an additional verification step.
  • Use Invisible Score-Based Protection
    Enable reCAPTCHA v3 when you want bot scoring without displaying a checkbox inside every form.
  • Secure Membership Websites
    Protect supported registration, login, password reset, and checkout forms used by membership plugins.

Frequently Asked Questions

Related Modules

Activity Log

Keep a clear record of important dashboard activity—who logged in, what changed, and when—so you can investigate issues or stay audit-ready without...
Security
Disabled

Limit Login Attempts

Slow down password-guessing bots by locking out repeated failed logins for increasing cool-off periods—simple protection for your sign-in form.
Security
Disabled

Simple CAPTCHA

Ask a quick math question, custom prompt, or image check before someone can submit a form or log in. Everything runs on...
Security
Disabled

Disable XML-RPC

Closes the old XML-RPC channel many password-guessing tools still target. Fine for most sites; skip if you rely on legacy apps or...
Security
Disabled

Disable Password Reset

Turn off public "forgot password" self-service for everyone. Use only when you reset passwords another way (manual admin password, WP-CLI, or admin-sent...
Security
Disabled

Email Obfuscator

Automatically protects visible email addresses and mailto links from basic spam bots by safely encoding them while keeping them clickable for visitors.
Security
Disabled

Password Protection

Put your whole site behind one shared password—ideal for staging, client previews, or a soft launch before you go public.
Security
Disabled

Disable REST API

Block anonymous access to WordPress core REST endpoints (users, settings, themes, and similar) while leaving logged-in staff and third-party plugin REST routes...
Security
Disabled

IP Allow & Block List

Allow or block visitors by IP address—ideal for office-only dashboards or shutting out known troublemakers. Rules apply site-wide, including wp-admin and login.
Security
Disabled

Force SSL Admin

Always open your dashboard and login screen over a secure https:// link. Anyone using the old http:// address is sent to the...
Security
Disabled