# Google reCAPTCHA

Set up Google reCAPTCHA v2 or v3 on a Form Plume form: add the widget, send the token, tune the v3 minimum score, and keep your secret key server-side.

Google reCAPTCHA can show a checkbox or return an invisible risk score. See [when to require a CAPTCHA](/docs/spam-protection/captcha) before wiring up reCAPTCHA.

Use v2 when you want visitors to see and complete a visible challenge; use v3 when you prefer a silent risk score and would rather not interrupt the form. Either way the form sends the result to Form Plume as `g-recaptcha-response`.

## reCAPTCHA v2

Create a v2 checkbox key pair, save it under **Spam protection**, and add the widget:

```html
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>
```

The form sends `g-recaptcha-response` for Form Plume to verify.

## reCAPTCHA v3

Create a v3 key pair and execute reCAPTCHA before submitting. Send the returned token as `g-recaptcha-response`.

Set the minimum score in Form Plume. Start with a moderate threshold and adjust it using real traffic. A higher threshold blocks more bots and creates more false positives.

Never place the provider secret in the page. Only the site key is public.