Google reCAPTCHA

Google reCAPTCHA can show a checkbox or return an invisible risk score. See when to require a CAPTCHA before wiring up reCAPTCHA.

Use v2 when you want visitors to see and complete a visible challenge; use v3 when you prefer a silent risk score and would rather not interrupt the form. Either way the form sends the result to Form Plume as g-recaptcha-response.

reCAPTCHA v2

Create a v2 checkbox key pair, save it under Spam protection, and add the widget:

<script src="https://www.google.com/recaptcha/api.js" async defer></script>
 
<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>

The form sends g-recaptcha-response for Form Plume to verify.

reCAPTCHA v3

Create a v3 key pair and execute reCAPTCHA before submitting. Send the returned token as g-recaptcha-response.

Set the minimum score in Form Plume. Start with a moderate threshold and adjust it using real traffic. A higher threshold blocks more bots and creates more false positives.

Never place the provider secret in the page. Only the site key is public.