How to Choose reCAPTCHA for a Form and Get the Keys

The types

• “I’m not a robot” checkbox — formerly v2 checkbox. The visitor ticks a box and sometimes solves an image challenge. Clear and reliable, but it adds a step.
• Score-based, no challenge — formerly v3. The visitor sees nothing: reCAPTCHA assesses behaviour and returns a score from 0.0 (likely a bot) to 1.0 (likely a human). What to do with a low score is up to your site.
• Invisible with a challenge on suspicion — formerly v2 invisible. New keys of this type can’t be created in the Google Cloud console; Google suggests a standard website key instead.

How to choose

• A regular contact or enquiry form — start with the score-based type: visitors notice nothing. What matters is that your site or form plugin can check the score and reject submissions below a threshold. Google suggests 0.5 as a starting threshold.
• Sign-up, login or forms under active attack — the checkbox is more reliable: a bot has to pass the challenge.
• Your form plugin supports only one type — use that one. Keys of different types aren’t interchangeable.

Step 1. Create a key in Google Cloud

1. Open the Google Cloud console and select or create a project for your site.
2. Go to the reCAPTCHA page. It currently sits under Fraud Defense; the direct address is console.cloud.google.com/security/recaptcha.
3. Create a key: give it a clear name, choose the website platform and add the domains where the form will run.
4. Choose the type: checkbox or score-based.

The Key ID is your site key — the one you put into the form.

Step 2. Find the secret key for your plugin

Most form plugins and CMSs ask for a pair: site key + secret key. The Google Cloud console doesn’t show the secret key by default. To get it:

1. Open the key on the Keys tab and go to the Integration tab.
2. Click Use Legacy Key or, if the key isn’t set up for that yet, Integrate with a third-party service or plugin.
3. Copy the secret key from the dialog. Keep it like a password: it must never end up in your page code.

Step 3. Test the form

• Send a test submission — it should arrive.
• Make sure the reCAPTCHA badge or checkbox actually appears on the form.
• If you use scores, check in the console what scores submissions get, and adjust the threshold if needed.

The limit: 10,000 assessments a month

Without billing enabled, reCAPTCHA performs 10,000 free assessments a month. For a small site with a contact form, that’s usually plenty. One important detail: if the limit runs out and billing isn’t enabled, the older verification method (SiteVerify) that most plugins use doesn’t block submissions — it lets them through with a score of 0.9. Protection effectively switches off and spam starts flowing again.

If a contractor once created your key

During the automatic migration, Google created Google Cloud projects and sent invitations to the owners of the old keys. Keys keep working even if the invitation isn’t accepted, but you can only change them after accepting it. If the key’s administrator is no longer reachable, the project can’t be recovered — it’s simpler to create a new key in your own project and swap it into the form.

In short

1. For a regular form, start with score-based; for login and sign-up, with the checkbox.
2. Keys are created in the Google Cloud console, on the reCAPTCHA page.
3. The secret key for a plugin is on the key’s Integration tab.
4. 10,000 free assessments a month; beyond that without billing, protection stops working.
5. If an old key is out of reach, create a new one in your own project.

If your forms are flooded with spam or the captcha stopped working after the key migration, we can protect your forms with reCAPTCHA: choose the type, set up keys in your project, connect them and test the submissions.