Spam orders or signups are still getting through
Updated September 13, 2026
reCAPTCHA stops automated form submissions, but it is not a complete anti-fraud system. If spam is still arriving after the plugin is set up, the usual explanations are that the affected form is not protected, that the spam is not automated, or that an exemption is letting it through.
Confirm the right form is protected
Each form has its own checkbox at Settings › reCAPTCHA WooCommerce, and enabling the checkout does nothing for registrations. Work out which form the spam actually arrives through, then confirm that specific option is ticked and that the widget appears when you view the form as a guest.
The plugin does not cover comment forms, contact form plugins or product reviews. Spam through those needs protection from the plugin that renders them.
Check your exemptions
Any exemption is a hole a determined attacker can aim at. Review each one:
- Payment Methods to Skip removes the check entirely for those gateways. If card testing is hitting a skipped gateway, unskip it.
- Guest Checkout Only and Whitelist logged-in users both exempt anyone with an account. If attackers are registering accounts first, turn these off.
- Whitelisted IP Addresses and Whitelisted User Agents can both be spoofed by anyone who learns the values. Remove entries you no longer need.
Consider whether the spam is actually automated
reCAPTCHA v2 is designed to tell humans from bots. It does not stop a human who is willing to tick a box, and cheap human-powered services exist for exactly this. If the submissions vary in wording, arrive at a human pace, or follow your form changes, you are probably not dealing with a bot.
Fraud screening at the payment gateway, order limits, or manual review are better tools for that problem than a CAPTCHA.
Check the verification is actually running
A widget that renders is not proof the server-side check works. Submit a protected form without ticking the box and confirm you are stopped with an error. If the submission goes through, verification is not running and the rest of your configuration does not matter.
Re-run the Test API Response check if that happens.
Layer other defences
For persistent attacks, combine reCAPTCHA with rate limiting at your host or firewall, email verification before account activation, and your payment gateway’s own fraud rules. No single CAPTCHA handles everything.