reCAPTCHA for WooCommerce

How can we help?

Search the documentation or ask the AI agent anything about the plugin.

Create your reCAPTCHA v2 API keys

Updated September 13, 2026

The plugin needs a pair of Google reCAPTCHA keys before it will show anything on your forms. You generate them free of charge in the Google reCAPTCHA admin console, then paste them into Settings › reCAPTCHA WooCommerce under API Key Settings.

Register your site with Google

  1. Go to https://www.google.com/recaptcha/admin/create and sign in with a Google account.
  2. Give the site a label you will recognise later, such as your shop name.
  3. For the reCAPTCHA type, choose Challenge (v2) and then the “I’m not a robot” tickbox option.
  4. Add your domain under Domains. Enter it without https:// and without a trailing slash, for example example.com.
  5. Accept the terms of service and submit.

Google then shows two values: a site key and a secret key. Copy both.

Which reCAPTCHA version to pick

This plugin only supports reCAPTCHA v2 Challenge keys. reCAPTCHA v3 and Invisible reCAPTCHA keys will not work; they use a different verification flow and will fail the API test with an invalid-input-secret or similar error.

If you already created a v3 key by mistake, create a second site entry in the Google console with the Challenge (v2) type rather than trying to convert the existing one.

Add the keys to the plugin

  1. Go to Settings › reCAPTCHA WooCommerce.
  2. Paste the site key into Site Key / ID and the secret key into Secret Key.
  3. Click Save Changes, then run the test that appears at the top of the page.

Take care not to swap the two values. The site key is sent to the browser and is public; the secret key is only ever used server-side and should never be shared or added to a theme file.

Define the keys in wp-config.php instead

If you would rather keep the keys out of the database, define them as constants instead. Expand Optional: Define keys in wp-config.php under the key fields to see this documented in the plugin itself. Add the following to wp-config.php above the line reading /* That's all, stop editing! Happy publishing. */:

define('RECAPTCHA_WOO_SITE_KEY', 'YOUR_SITE_KEY');
define('RECAPTCHA_WOO_SECRET_KEY', 'YOUR_SECRET_KEY');

Constants take precedence over whatever is saved on the settings screen. This suits version-controlled or multi-environment setups where each environment supplies its own keys. It is entirely optional, so skip it if you are not comfortable editing wp-config.php.

Domains, subdomains and staging sites

Google validates the key against the domain the form is served from. A key registered for example.com covers its subdomains by default, but a separate staging domain such as example.staging.site needs either its own key pair or the domain added to the existing key’s domain list.

If you move a site to a new domain, add the new domain in the Google console before switching, or the checkbox will show an error instead of loading.

Related

Was this article helpful?