Protect a public form with reCAPTCHA

POM Forms can verify Google reCAPTCHA before either the internal AJAX pipeline or an external action request runs. Configure the site keys first, then decide whether each form should use them.

Configure the integration

1. Obtain keys for the intended production domain from Google reCAPTCHA.
2. Open Settings → POM Theme → Integrations → Google reCaptcha.
3. Enter Public key and Private key.
4. Select reCaptcha version:
   • v2
   • v3 - Invisible
5. Save the theme settings.

Keys must match the selected version and the public domain.

When both keys are saved, the standard WooCommerce My Account registration form is protected automatically, independently of the per-form control below. See customer registration protection for setup, verification, and scope.

Enable protection on a form

1. Open the form.
2. Go to Messages/Behavior → Advanced Behavior.
3. Enable Enable reCAPTCHA.
4. Under Custom Messages, review Missing reCAPTCHA Message and Failed reCAPTCHA Message.
5. Save the form.

The control is unavailable when no usable site keys are configured. New forms default to reCAPTCHA enabled when the integration is available, so verify rather than assume.

Combine protection with sound form design

• Keep upload limits narrow.
• Avoid publishing unnecessary recipient addresses.
• Use Show Loading Indicator and disable the form after success when repeat clicks are a concern.
• Monitor sudden increases in submissions or external automation.
• Treat client-side hidden fields as untrusted input.

reCAPTCHA reduces automated abuse; it does not validate business intent or replace server-side field validation.

Test before launch

1. Submit normally from the public domain while signed out.
2. Confirm a missing or failed challenge produces the configured message.
3. Test the form on mobile and with keyboard navigation.
4. Verify success still reaches every required destination.
5. Retest after changing the domain, keys, or reCAPTCHA version.

If every request fails, compare the key type, selected version, and allowed domain. If reCAPTCHA does not appear or run, confirm the integration keys are saved and Enable reCAPTCHA remains active for the form.