reCAPTCHA for WooCommerce

How can we help?

Search the documentation or ask the AI agent anything about the plugin.

Run the Test API Response check

Updated September 13, 2026

The Test API Response step confirms your keys work before the plugin starts blocking real submissions. It appears at the top of Settings › reCAPTCHA WooCommerce whenever your keys have not yet been verified, and it must pass before reCAPTCHA is added to the WordPress login form.

Run the test

  1. Save your site key and secret key.
  2. A box headed “Almost done…” appears at the top of the settings page with a live reCAPTCHA widget inside it.
  3. Tick the reCAPTCHA checkbox and complete any image challenge Google shows you.
  4. Click TEST RESPONSE.

On success the box is replaced by a green bar reading “Success! reCAPTCHA seems to be working correctly with your API keys.” That state is remembered, so the test box will not come back on every page load.

What the test actually checks

The test exercises the same code path as a real form submission. Your browser solves the challenge with the site key, then your server posts the resulting token to Google’s verification endpoint using the secret key. A pass therefore tells you three things at once:

  • The site key is valid for this domain, because the widget rendered at all.
  • The secret key matches that site key.
  • Your server can reach google.com over outbound HTTPS, which some locked-down hosts block.

Why the WordPress login form waits for a pass

If reCAPTCHA were added to wp-login.php with keys that do not work, nobody could log in, including you. To avoid that, the plugin only attaches to the WordPress login form once the test has passed. Everything else, including the WooCommerce forms, is controlled purely by the checkboxes in settings.

When the test resets

Changing either the site key or the secret key marks the keys as untested again, and the test box reappears. This is deliberate. Run the test again after any key change so you find a typo on the settings screen rather than on your login page.

The verified state is stored in the rcfwc_tested option. Developers restoring a database or scripting a deployment can set it, though running the test properly is safer.

Related

Was this article helpful?