Set up reCAPTCHA on your store
Updated September 13, 2026
reCAPTCHA for WooCommerce adds a Google reCAPTCHA v2 “I’m not a robot” checkbox to your WooCommerce and WordPress forms, which cuts down on spam registrations, brute-force login attempts and fraudulent orders. Every setting lives on a single page at Settings › reCAPTCHA WooCommerce.
Setup takes four steps: install the plugin, add your API keys, run the built-in API test, then tick the forms you want protected.
Install and activate the plugin
- In WordPress admin, go to Plugins › Add New and search for “reCAPTCHA for WooCommerce”.
- Click Install Now, then Activate.
WordPress takes you straight to the settings page the first time you activate the plugin. After that, reach it from Settings › reCAPTCHA WooCommerce or the Settings link next to the plugin on the Plugins screen.
The plugin needs WordPress 4.7 or newer. WooCommerce 3.4 or newer is required only for the WooCommerce forms; the WordPress login, registration and password reset options work without WooCommerce installed.
Add your site key and secret key
Under API Key Settings, paste your credentials into Site Key / ID and Secret Key, then click Save Changes. The plugin supports reCAPTCHA v2 “Challenge” keys only, so make sure you selected that type when registering your site with Google.
Nothing appears on your forms until both fields are filled in. If either one is empty, the plugin quietly does nothing rather than blocking submissions.
Run the Test API Response check
After saving your keys, a test box appears at the top of the settings page. Tick the reCAPTCHA checkbox and press TEST RESPONSE. A green “Success!” message confirms your keys and your server’s connection to Google are both working.
This test is not optional for the WordPress login form. reCAPTCHA is not added to wp-login.php until the test passes, which prevents you locking yourself out with bad keys.
Choose which forms to protect
Tick the boxes under WordPress Forms and WooCommerce Forms for each form you want covered, then save. The WooCommerce section is greyed out if WooCommerce is not active.
Once saved, open the relevant page in a private browsing window and confirm the checkbox appears. Logged-in administrators do not see the checkout reCAPTCHA if Guest Checkout Only is enabled.