How to add reCaptcha in WPForms

What Is Google reCAPTCHA and Why Does Your Form Need It?

Google reCAPTCHA is a free security service that protects your website forms from spam, bots, and automated abuse. It works by using a challenge-response system — it presents the user with a small task that is easy for a real person but very difficult for an automated script or bot. Think of it as a bouncer at the door of your contact form. Without it, spam bots can find your contact form URL and hammer it with hundreds of fake submissions per day. Your inbox fills up with junk, and important messages from real clients get buried. For local businesses — salons, clinics, gyms, restaurants — this is a real problem because you depend on that contact form to hear from potential customers. Adding reCAPTCHA to your WPForms contact form stops this cold. Bots get blocked at the gate. Real visitors sail right through. It is one of the simplest, most effective things you can do to protect your site’s forms.

Does WPForms Free Support reCAPTCHA?

Yes — and this surprises a lot of people. The free version of WPForms fully supports Google reCAPTCHA. You do not need to upgrade to WPForms Pro just to protect your forms from spam. While it is true that the free version does not include every field type (phone number fields, for example, are locked behind the paid plan), the reCAPTCHA feature is available in the free edition. So if you are running a small business site on a tight budget, you can have a working, spam-protected contact form without spending a cent on the plugin itself. That is a great deal, and it is one of the main reasons I recommend WPForms to clients who are just starting out.

Which reCAPTCHA Type Should You Choose?

WPForms gives you a few different options when it comes to reCAPTCHA type. Here is a plain-English breakdown of each so you can pick the right one for your site: – **reCAPTCHA v2 Checkbox** — This is the classic ‘I’m not a robot’ checkbox that most people are familiar with. The user has to tick a box before submitting. Sometimes it triggers an image puzzle (pick all the traffic lights, etc.). It is very effective but adds a small extra step for your visitors. – **reCAPTCHA v2 Invisible** — Works silently in the background. Most real users will never see anything. Only suspicious-looking traffic gets a challenge. This is a great middle ground — strong protection without annoying your legitimate visitors. – **reCAPTCHA v3** — Completely invisible and runs a risk-scoring system behind the scenes. There is no user interaction at all. It is more advanced but also a bit trickier to configure correctly, as you need to set a score threshold. For most of my local business clients, I recommend reCAPTCHA v2 Invisible — it is easy to set up, it is transparent to real users, and it stops the vast majority of bots without any friction.

Step 1 — Register Your Website on Google reCAPTCHA Console

Before you can connect reCAPTCHA to WPForms, you need to register your website with Google and get two keys — a Site Key and a Secret Key. Here is how to do that: – Go to the Google reCAPTCHA admin console at: https://www.google.com/recaptcha/admin/create – Sign in with your Google account. – Give your reCAPTCHA a label (usually your website name works fine). – Choose your reCAPTCHA type — select v2 if you are following this tutorial. – In the Domains field, enter your website’s domain name (for example: yourbusiness.com). Do not include ‘https://’ or ‘www’ — just the bare domain. – Agree to the Google Terms of Service and click Submit. – On the next screen, you will see two keys: your Site Key and your Secret Key. Keep this tab open — you will need to copy these in the next step.

Step 2 — Add Your reCAPTCHA Keys in WPForms Settings

Now head back to your WordPress dashboard and follow these steps to connect the keys to WPForms: – In the WordPress admin sidebar, go to WPForms → Settings. – Click on the CAPTCHA tab at the top. – Select reCAPTCHA as your CAPTCHA provider. – Choose your reCAPTCHA type (v2 Checkbox, v2 Invisible, or v3). – Paste your Site Key into the Site Key field. – Paste your Secret Key into the Secret Key field. – Click Save Settings. That is the global connection done. You have told WPForms where to find your reCAPTCHA setup. But you are not quite finished — you still need to enable it on your actual contact form, which is Step 3.

Step 3 — Enable reCAPTCHA on Your Contact Form

Saving your keys in Settings does not automatically apply reCAPTCHA to every form on your site. You need to add the reCAPTCHA field to each specific form where you want it. Here is how: – Go to WPForms → All Forms. – Click Edit on the contact form you want to protect. – Inside the form builder, look at the list of available fields. You should see a reCAPTCHA field option. – Drag and drop the reCAPTCHA field onto your form — typically it goes just above the Submit button. – Once added, you should see a success confirmation that reCAPTCHA is enabled for that form. – Click Save to save the form. Repeat this process for any other forms on your site that need spam protection — like quote request forms, booking forms, or newsletter sign-ups.

Step 4 — Test That reCAPTCHA Is Working

Never skip testing. Once you have set everything up, go to the page on your website where your contact form is displayed and test it yourself. – If you chose v2 Checkbox reCAPTCHA, you should see the ‘I’m not a robot’ checkbox appear on your form. Tick it and submit a test message. – If you chose v2 Invisible, you will not see anything visual — just submit the form normally and confirm that the submission goes through and you receive the email notification. – If reCAPTCHA is not appearing on your form at all, double-check that you dragged the field into the correct form and that you saved it. – If the form is not submitting, the most likely cause is that your Site Key or Secret Key was entered incorrectly — go back to WPForms Settings and re-paste the keys carefully.

Troubleshooting Common reCAPTCHA Problems in WPForms

Most issues with reCAPTCHA in WPForms come down to a small number of common mistakes. Here is what to check if something is not working: – **Form not submitting at all** — This is almost always caused by mismatched or incorrectly pasted reCAPTCHA keys. Go to WPForms → Settings → CAPTCHA and re-enter your keys from the Google console. Make sure there are no extra spaces. – **reCAPTCHA badge not showing** — Make sure you added the reCAPTCHA field directly inside the form builder, not just in Settings. You have to drag the field onto each individual form. – **Domain not registered** — If you get a domain mismatch error, make sure you entered your domain exactly as it appears in your browser URL when you registered in the Google console. – **Plugin conflict** — If another plugin is blocking Google scripts from loading, reCAPTCHA will silently fail. Try temporarily deactivating other plugins one by one to identify the conflict. – **Legitimate users being blocked** — If you are using v3 and real users cannot submit the form, your score threshold may be too strict. Lower it slightly in the WPForms CAPTCHA settings (for example, from 0.7 down to 0.5).

Frequently Asked Questions

Is reCAPTCHA available in the free version of WPForms?

Yes, the free version of WPForms fully supports Google reCAPTCHA. You do not need to upgrade to WPForms Pro to use this spam-protection feature. It is one of the most useful things included in the free plugin.

What is the difference between reCAPTCHA v2 and v3 in WPForms?

reCAPTCHA v2 asks users to click a checkbox or solve an image puzzle to prove they are human. reCAPTCHA v3 works silently in the background with no user interaction — it assigns a risk score to each visitor’s behavior. For most small business contact forms, reCAPTCHA v2 Invisible is the easiest to set up and strikes the best balance between security and user experience.

Why is my WPForms contact form not submitting after adding reCAPTCHA?

The most common cause is incorrect or mismatched reCAPTCHA keys. Go to WPForms → Settings → CAPTCHA and carefully re-paste your Site Key and Secret Key from the Google reCAPTCHA admin console, making sure there are no extra spaces or missing characters.

Do I need a paid Google account to use reCAPTCHA?

No. Google reCAPTCHA is free for standard use. You just need a regular Google account to register your website and generate the API keys. Google may prompt you to set up a billing account only if your traffic volume becomes very large and exceeds the free tier.

How do I add reCAPTCHA to multiple forms in WPForms?

You only need to enter your Google API keys once in WPForms Settings. After that, open each form individually in the WPForms form builder, drag the reCAPTCHA field onto the form, and save it. Repeat this for each form you want to protect.

Will adding reCAPTCHA slow down my website?

Adding reCAPTCHA loads a small Google script on your page, which can add a very minor amount of load time. In practice, for most local business websites the impact is negligible. The benefit of stopping spam far outweighs any minimal performance consideration.

Final Thoughts

And that is all there is to it! Adding Google reCAPTCHA to your WPForms contact form is one of those five-minute tasks that saves you hours of frustration dealing with spam. I have done this on hundreds of local business sites — salons, clinics, restaurants, coaches — and it works every single time. If you are more of a visual learner, make sure you watch my YouTube video tutorial on this exact topic — I walk through every step on screen so you can follow along at your own pace. If you found this helpful, please drop a comment below and let me know. Got a question or ran into a problem at any step? Ask away in the comments — I read every one. And if you would rather have someone set this up for you, feel free to reach out to me directly at paramfreelance.com. I am always happy to help.