The plugin exposes two filters for developers who need to change when the reCAPTCHA check runs. Both are intended for integrations that have their own way of establishing that a request is legitimate.

Add these to a site-specific plugin or your theme’s functions.php. There are no actions intended for third-party use.

recaptcha_skip_on_express_pay

Controls whether the reCAPTCHA check is skipped for an express payment on the Checkout block. It runs during Store API checkout processing, and does not apply to the classic shortcode checkout.

By default it returns true when the payment method is WooPayments or Stripe and express payment markers are present in the submitted payment data.

apply_filters( 'recaptcha_skip_on_express_pay', $skip, $payment_method, $payment_data, $request );

• $skip (bool) — whether to skip the check.
• $payment_method (string) — the gateway ID submitted with the order.
• $payment_data (array) — the payment data from the Store API request.
• $request — the Store API request object.

// Skip the check for a custom express gateway.
add_filter( 'recaptcha_skip_on_express_pay', function( $skip, $payment_method, $payment_data, $request ) {
    if ( 'my_express_gateway' === $payment_method ) {
        return true;
    }
    return $skip;
}, 10, 4 );

rcfwc_wp_login_checks

Bypasses the reCAPTCHA check on the WordPress login form. Return true and the login proceeds without verification. It takes a single argument, which defaults to false.

apply_filters( 'rcfwc_wp_login_checks', false );

This exists for integrations that authenticate through the standard login flow but cannot present a challenge, such as single sign-on providers or programmatic logins.

// Bypass the WP login check for requests carrying an SSO marker.
add_filter( 'rcfwc_wp_login_checks', function( $skip ) {
    if ( my_sso_request_is_active() ) {
        return true;
    }
    return $skip;
} );

Returning true unconditionally disables reCAPTCHA on the login form entirely, which leaves it open to credential stuffing. Scope the condition as narrowly as you can.

Checks that are built in

Some exemptions are applied without a filter and need no code. XML-RPC and REST API requests are skipped on the login and registration checks, so app logins and headless integrations keep working. Gateways listed under Payment Methods to Skip, and any visitor matching the whitelist settings, are also exempted before these filters are reached.

Check those settings before writing code. Most requirements are met without a filter at all.

Related

• Plugin options reference
• Express checkout compatibility
• Whitelist users, IPs and user agents