reCAPTCHA for WooCommerce

How can we help?

Search the documentation or ask the AI agent anything about the plugin.

Plugin options reference

Updated September 13, 2026

The plugin stores its configuration in individual WordPress options, all prefixed rcfwc_. This reference lists them for developers scripting deployments, writing migrations, or debugging a site’s state directly in the database.

Checkbox options store an empty string when unticked, so test them for truthiness rather than comparing to a specific value.

API keys and appearance

  • rcfwc_key — the reCAPTCHA v2 site key.
  • rcfwc_secret — the reCAPTCHA v2 secret key.
  • rcfwc_themelight or dark.
  • rcfwc_testedyes once the Test API Response check has passed. Reset to no whenever either key changes.

Keys can also be supplied as constants in wp-config.php, which take precedence over the stored options:

define('RECAPTCHA_WOO_SITE_KEY', 'YOUR_SITE_KEY');
define('RECAPTCHA_WOO_SECRET_KEY', 'YOUR_SECRET_KEY');

WordPress form options

  • rcfwc_login — protect the WordPress login form.
  • rcfwc_login_only — restrict that to wp-login.php only.
  • rcfwc_register — protect the WordPress registration form.
  • rcfwc_register_only — restrict that to wp-login.php only.
  • rcfwc_woo_reset — protect the password reset form. Despite the name, this covers both the WordPress and WooCommerce reset forms.

WooCommerce form options

  • rcfwc_woo_login — the My Account login form.
  • rcfwc_woo_register — the My Account registration form.
  • rcfwc_woo_checkout — the checkout.
  • rcfwc_woo_checkout_pay — the pay for order page.
  • rcfwc_guest_only — show and verify at checkout for guests only.
  • rcfwc_woo_checkout_pos — widget position. One of beforepay, afterpay, beforebilling, afterbilling, beforesubmit. Empty is treated as beforepay.
  • rcfwc_selected_payment_methods — array of gateway IDs to skip.

Advanced options

  • rcfwc_scripts_all — load scripts on all pages.
  • rcfwc_error_message — custom failure message. Blank uses the default.
  • rcfwc_whitelist_users — skip the check for logged-in users.
  • rcfwc_whitelist_ips — newline-separated IP addresses. No wildcards.
  • rcfwc_whitelist_agents — newline-separated User-Agent substrings.

Related

Was this article helpful?