How to use reCAPTCHA with WPForms

Set up reCAPTCHA with WPForms to Identify, Block, and Avoid Spam

I’m embarrassed to say that I got really excited yesterday thinking that several people had requested price quotes from me. Turns out I forgot a step when i set up my price quote form. 🙁 I guess it’s not all bad….I had time to write these instructions…and make a demo video for anyone who needs it. You can also download a PDF version if that’s your thing.


In this presentation, we’ll look at how to set up reCAPTCHA with WPForms so that we are better able to block and avoid spam that is sent through various types of forms, such as contact forms, request for price quotes, newsletter sign-ups, etc.

  • WHAT? How to use reCAPTCHA with WPForms
  • WHY? To identify, block, and avoid spam
  • WHERE? On website contact forms such as requests for price quotes, newsletter sign-ups, etc.

While using reCAPTCHA along with a solid contact form product like WPForms is a highly effective way to avoid spam email, no solution is 100% effective. For this reason, it is important to educate ourselves about spam so that we can identify spam when we see it and avoid it whenever possible. We also want to ensure that we don’t misidentify legitimate communications from our website visitors as spam, and miss out important correspondence.

Action Items

As we move through the lesson, we will learn by doing, as we complete the following action items:

  • Set up WPForms entries tab to maximize our ability to recognize any spam that might come through.
  • Connect WPForms with reCAPTCHA to block spam, keeping it from reaching our inboxes in the first place.

Let’s get started!

Identify Spam: WPForms Workflow Set Up

From the WPForms tab in the WordPress menu:

  • Select “Entries”
  • If you have a form with entries already, select it. Otherwise, any form will do.
  • Once you have selected your form, you’ll see all of the entries you’ve received for that form. The fields you can see are selected by default unless you select them yourself.
  • Click the navigation wheel on the far right, and set the fields you want to see when viewing entries.

These fields come directly from your form and you can select whichever ones you want to see first. Personally, I like to see answers to the “long paragraph” questions because bots never fill these out, and if they did, you’d know it.

In fact, this is exactly how reCAPTCHA works to identify spambots on your forms. Similar to writing long essays, selecting crosswalks and traffic lights is challenging for bots, which is why these and other types of “puzzles” are used to filter the bots away from our email forms. You can use this concept to your advantage here by selecting fields that will provide the most info to help you identify spammers. You may be wondering:

What exactly am I looking for? What are some signals that an email is likely to be spam?

Common Characteristics of Spam Email:

  • All of the answers in every field are selected, whether it makes sense or not.
  • There are multiple links in the paragraph field, or important paragraph fields are left completely blank.
  • Responses have nothing to do with the topic of the form, or your site. Often this will show up as a very poor attempt to make something completely unrelated to your site seem relevant.
  • You see responses from multiple email addresses with the same unusual location and/or lots of seemingly random numbers, letters and other symbols are used in the email address.
  • You see multiple responses coming in within the same minute.
  • Inauthentic flattery – The compliment will be irrelevant to who you actually are or just seem “off”.

What to Do With Spam Email in Your Forms Inbox

Unfortunately, scammers will often attempt to play upon our emotions with promises of realizing our wildest dreams or suffering our worst and biggest fears in order to get us to click. Don’t be fooled. Whether the spam comes from a human or a bot, and no matter how promising it seems, there is no good that will come from engaging with it. Instead, do the following:

  • Check and delete any spam by using the bulk edit tool.
  • To prevent unwanted spam in the future, set up reCAPTCHA.

Block and Avoid Spam: Set Up reCAPTCHA in WordPress with WPForms

What Exactly is reCAPTCHA?

reCAPTCHA is a free service offered by Google that helps do some of the work of identifying spam for you before the spam ever reaches your inbox! All you need is a Google account to set it up.

Allow me to share how my own journey with reCAPTCHA started this morning: (Hint: If you try to add the reCAPTCHA field to one of your forms, you’ll be guided to the right place.)

  • Pick a form, any form
  • Click “Edit Form”
  • Select “Fields” from the tabs menu.
  • Select “reCAPTCHA”

You’ll be directed by pop up to set up reCAPTCHA.

  • Click the link in the pop up to navigate to your WPForms settings page in WordPress.
  • Or just navigate to the WPForms settings page directly

Generating reCAPTCHA Keys in Google

Once you are on the WPForms settings page…

  • Select “reCAPTCHA from the tabs menu at the top.
  • Click Read our walkthrough, which will take you to the reCAPTCHA documentation and instructions page provided by WPForms. It offers very detailed instructions which will be handy if you need them, but for now, let’s stay focused and find this section of the documentation and click the link to register reCAPTCHA.
Generating reCAPTCHA Keys in Google

You will now be whisked away to Google’s reCAPTCHA landing page, where you will …

  • Find the blue “Admin Console” button and click it.
  • Register and receive keys to your reCAPTCHA.

A Few Important Notes About Registering reCAPTCHA

  • If you don’t already have a Google account, you’ll need to set one up.
  • You have three options when selecting your reCAPTCHA. Two are invisible, one is not.
  • When Invisible reCAPTCHA is used, you won’t see any extra field or checkbox within your form. When they say “invisible” they mean it. It’s really very invisible. Instead, a small badge is added to the lower right corner of the screen that links to Google’s terms of service and privacy policy.
  • Each reCAPTCHA type requires a different set of keys, so if you later decide to switch types you will need to generate a new set of keys.

Once you complete the reCAPTCHA registration…

You will immediately receive two keys: a site key and a secret key. These will appear on your screen when you finish registration.

  • Copy the site and secret keys
  • Return to the WPForms settings reCAPTCHA page and enter both keys in the corresponding fields.
  • Go back to your form and click the reCAPTCHA button to enter the field.

Save your form!
Test your form to be sure it is working.

If you get stuck, refer to the WPForms documentation. (links available throughout this presentation for your convenience)

Leave a Reply

Your email address will not be published. Required fields are marked *