Forms you can protect with reCAPTCHA
Updated September 13, 2026
The plugin can add a reCAPTCHA checkbox to eight forms in total, split between WordPress core forms and WooCommerce forms. You enable each one individually with a checkbox at Settings › reCAPTCHA WooCommerce.
WordPress forms
These are the core forms served from wp-login.php. They work whether or not WooCommerce is installed.
- WordPress Login — the main admin login form. Only activates once the Test API Response check has passed.
- WordPress Register — the core registration form, if open registration is enabled on your site.
- Reset Password — the lost password form.
The Reset Password checkbox covers both the WordPress lost password form and the WooCommerce one, so ticking it protects the My Account version as well.
WordPress Login and WordPress Register each have an Only on wp-login.php sub-option. Tick it to restrict the challenge to the core login screen, leaving any front-end login or registration form your theme or another plugin renders untouched.
WooCommerce forms
This whole section is greyed out and inactive if WooCommerce is not active on the site.
- WooCommerce Login — the login form on the My Account page.
- WooCommerce Register — the registration form on the My Account page.
- WooCommerce Checkout — works on both the classic shortcode checkout and the newer Checkout block.
- WooCommerce Pay for Order Page — the pay-for-order page customers reach from a payment link on a pending order.
The checkout option has two extra settings of its own: Guest Checkout Only, and Widget Location on Checkout for choosing where the box sits in the form.
Registration during checkout
When a customer ticks “Create an account?” on the checkout page, the plugin does not run a second, separate check for the registration form. The checkout verification covers the whole submission, so the customer only completes one challenge.
Forms that are not covered
The plugin does not add reCAPTCHA to the WordPress comment form, contact form plugins such as Contact Form 7 or Gravity Forms, WooCommerce product reviews, or third-party membership plugin forms. Those plugins generally ship their own reCAPTCHA integration.
Verification is also skipped for XML-RPC and REST API requests on the login and registration checks, so app logins and headless integrations keep working.