Google reCAPTCHA

Pro

Score submissions with Google reCAPTCHA and set the threshold your forms enforce.

Get xpac Pro Read the docs

One licence covers every Pro plugin

Visitor

a token, verified server-side

reCAPTCHA

Score check

Version: 1.0.0
WordPress: 6.5+
PHP: 7.4+
Tested up to: 7.1
Licence: GPLv3

What it does

A threshold you set

reCAPTCHA returns a score between 0 and 1. Choose where the line sits, so a form protecting a mailing list can be stricter than a contact form.

The badge is optional

Hide the floating badge and show Google’s required attribution as text instead, without breaking their terms.

Verified on the server

The token is checked against Google with your secret key before the submission is accepted, so a forged token in the browser gets nowhere.

Getting it working

01
Register your site

Create a reCAPTCHA v3 site in the Google admin console and copy the site key and secret key.
02
Add both keys

Paste them into the xpac settings screen and set your score threshold.
03
Enable it per form

Switch reCAPTCHA on for the forms that need it, and leave it off where it would only add weight.

Every setting

What you can configure, and where it lives. Site settings apply everywhere; the rest are set on the form itself.

Setting	Scope	Notes
Site Key	Site setting	Public. Reaches the browser.
Secret Key	Site setting	Write-only. Server side only.
Score Threshold	Site setting	0.0 to 1.0. Higher is stricter.
Disable Google reCAPTCHA Badge	Site setting	Hides the floating badge.

Questions

Ask support

What threshold should I use?

Google suggests 0.5. Start there, watch what gets blocked for a week, and move it in the direction the evidence points.

Is hiding the badge allowed?

Yes, as long as the attribution text appears instead. That text is added for you when the badge is hidden.

Does it work with v2 keys?

No. Scores are a v3 feature, so a v3 key pair is required.

Will a real person ever be blocked?

Occasionally, which is why the threshold is yours to set and blocked submissions are recorded rather than silently discarded.

More in Anti-spam & security

All plugins

Pro MaxMind Look up a visitor's country from their IP address using MaxMind's GeoLite2 service, so XPAC User Targeting can vary popups and forms by country. Pro Cloudflare Turnstile Protect XPAC Forms with a scoped Turnstile widget, server-side verification, and fail-closed configuration checks. Pro Akismet Classify XPAC Forms submissions with Akismet while keeping credentials write-only and failures reviewable.

Start using Google reCAPTCHA