How to Add Google reCAPTCHA to WooCommerce Checkout

Adding Google reCAPTCHA to your WooCommerce checkout takes about ten minutes and requires two things before you touch any plugin: a Google account and a free API key pair from the reCAPTCHA admin console. Most guides on how to add Google reCAPTCHA to WooCommerce checkout skip that requirement entirely and wonder why readers get stuck.

Bot attacks on WooCommerce checkouts have changed. Card-testing bots are smarter and more targeted than they were two years ago. Getting reCAPTCHA set up correctly, choosing the right version, and placing it where customers will actually see it; those details matter more than the setup itself.

This guide covers all of it. You’ll learn which reCAPTCHA version to pick, how to generate your API keys without the common mistakes, and how to set everything up using the WooCommerce Advanced CAPTCHA plugin.

Why Your WooCommerce Checkout Needs reCAPTCHA Right Now?

WooCommerce checkout security has become a serious concern, and the numbers are hard to ignore. According to Stripe’s fraud data, card-testing attacks increased by 134% in 2025, and WooCommerce stores are among the most targeted platforms. Cloudflare’s 2025 bot report found that 31.2% of all internet traffic is automated bot traffic, with eCommerce checkout pages sitting in the top five most targeted endpoints. Juniper Research reported that global eCommerce fraud losses exceeded $48 billion in 2025, with smaller stores bearing a large share because they have fewer security layers.

Here’s what those attacks look like in practice: a bot hits your checkout, submits dozens or hundreds of small orders using stolen card numbers to test which ones are active, then moves on. You’re left with failed orders, gateway fees, and sometimes a marked PayPal or Stripe account.

Knowing how to add Google reCAPTCHA to WooCommerce checkout and doing it correctly stops most automated bots from getting that far. It’s not a complete fraud solution on its own, but it removes the easiest path in.

More on what reCAPTCHA can and can’t stop in a moment.

reCAPTCHA v2 vs v3: Which One Should You Use?

This is the question most guides skip, and it’s the one that most affects how your checkout actually behaves.

	reCAPTCHA v2 Checkbox	reCAPTCHA v2 Invisible	reCAPTCHA v3
User sees it?	Yes, “I’m not a robot” box	Only if suspicious	Never
User interaction	One click (sometimes image challenge)	None unless activated	None
How it works	verification-based	Background analysis, challenge if marked	Risk score (0.0–1.0)
False positives	Low	Low	Requires limit adjustment
Setup complexity	Simple	Simple	Needs server-side score handling
Best for checkout?	Yes most stores	Yes lower difficulty	Use carefully; needs tuning

For most WooCommerce stores, v2 Checkbox is the safest starting point. It’s easy to set up, clearly blocks bots, and customers understand what they need to do. The one-click difficulty is small compared to the protection it adds.

reCAPTCHA v3 is more invisible but needs work to use correctly. It returns a score between 0.0 (likely a bot) and 1.0 (likely human). You set the threshold; Google’s default is 0.5, but that may be too strict or too relaxed for your specific traffic. If you set it wrong, you either miss bots or block real customers. Worth the setup if you run a high-traffic store and want a smooth experience. Not worth it if you just want checkout protection up and running today.

Important note: OPMC Anti-Fraud documentation specifically recommends only reCAPTCHA v2 for blocking card attacks, because v3’s score-based approach doesn’t properly block the rapid-fire submission patterns that card-testing bots use.

A Note on reCAPTCHA and the WooCommerce Block Checkout

Worth knowing before you go further.

reCAPTCHA protects the front-end checkout form. But in late 2024, card-testing bots started hitting the WooCommerce Store API, directly skipping the checkout page entirely. The WooCommerce Developer Blog covered this in December 2024, noting that bots targeting the Store API don’t interact with the form at all, so front-end CAPTCHA never fires.

If you’re running the Block-based Checkout (WooCommerce 8.5+), you may also need rate limiting on the /wc/store/v1/checkout endpoint alongside your reCAPTCHA setup. The WooCommerce Advanced CAPTCHA plugin handles the form-level protection. Rate limiting is an additional layer you can set up through Cloudflare or your hosting firewall.

For most stores on classic checkout, reCAPTCHA alone is a strong first layer. If you’re on Block Checkout and seeing REST API-based attacks, add rate limiting too.

How to Get Your Google reCAPTCHA API Keys

You need a Site Key and a Site Secret before anything else. Here’s how to get them without the common mistakes.

Step 1: Open the Google reCAPTCHA Admin Console

Go to google.com/recaptcha/admin/create and sign in with your Google account.

Step 2: Fill In Your Site Details

1. Add a label (anything descriptive, like your store name). Then choose your reCAPTCHA type. Select reCAPTCHA v2 if you want the checkbox, or reCAPTCHA v3 if you want invisible scoring.
2. Enter your domain in the domains field. Two common mistakes here: don’t include https:// and don’t add a trailing slash. Just the bare domain for example, yourstore.com.
3. Click Submit.

Step 3: Copy Your Site Key and Site Secret

After submitting, Google shows you both keys. Copy them somewhere safe; you’ll paste them into the plugin in a moment.

How to Add Google reCAPTCHA to WooCommerce Checkout

The WooCommerce Advanced CAPTCHA plugin handles reCAPTCHA, Cloudflare Turnstile, and hCaptcha, all from one settings panel. The steps below cover the Google reCAPTCHA setup specifically.

If you’re not sure the plugin is right for you, it supports all standard WooCommerce forms (checkout, login, registration, password reset, product reviews), plus Contact Form 7 and several other DevDiggers plugins. One plugin, one settings page, all your forms covered.

Step 1: Install and Activate the Plugin

1. From your WordPress dashboard, go to Plugins > Add New.
   
2. Upload the WooCommerce Advanced CAPTCHA plugin zip file that you’ve purchased.
   
3. Click Install Now, and the plugin will activate.
   

Step 2: Set up General Settings

1. Go to WooCommerce > Advanced CAPTCHA > Configuration.
   
2. In the General tab, toggle the plugin on.
   
3. Select Google reCAPTCHA in the CAPTCHA Type section.
   
4. Enable Whitelisted IPs. If you place test orders regularly, add your IP address here.
   
5. Click Save Changes.
   

Step 3: Set up Forms Settings

1. Switch to the Forms tab.
   
2. Under WooCommerce Forms, select All Users Checkout from the dropdown. This protects both guest and logged-in checkouts.
   
3. Then set the CAPTCHA Position for the WooCommerce Checkout Form. Placing it just above the “Place Order” button gets the best visibility, as customers see it right before they click.
   
4. Click Save Changes.
   

Step 4: Add Your reCAPTCHA Keys

1. Switch to the Google reCAPTCHA tab.
   
2. Select your Version v2, v2 Invisible, or v3. Match this to whichever type you registered in the admin console.
   
3. If you chose v2, select your preferred Size (Normal or Compact) and Theme (Light or Dark). These are cosmetic options, so pick what fits your store design.
   
4. If you chose v3, set the Minimum Score. Start with 0.5. If you see real customers getting blocked, lower it to 0.3. If bots are still getting through, raise it to 0.7 and monitor.
   
5. Paste your Site Key and Site Secret into the fields.
   
6. Click Save Changes.
   

Step 5: Test the Setup

1. Open an incognito browser window and add a product to your cart.
   
2. Then, go to checkout.
   
3. If you set up v2, you’ll see the “I’m not a robot” checkbox. If you set up v3, you’ll see the reCAPTCHA badge in the bottom-right corner.
   

Always test in incognito. If your IP is whitelisted or your user role is excluded in the plugin settings, you won’t see the CAPTCHA when logged in as admin. Testing incognito gives you the same view a real customer gets.

Quick Troubleshooting

reCAPTCHA isn’t showing on checkout. First, check you’re in incognito and not logged in as admin. Then confirm the plugin is enabled, the CAPTCHA type is set to Google reCAPTCHA, and the WooCommerce checkout form is selected under Forms settings. Also, check that no caching plugin is serving an old version of the page, and if yes, then clear your cache after setup.

The submit button still works without completing reCAPTCHA. Go back to the Google reCAPTCHA configuration tab and enable Disable Submit Button. That option must be turned on manually.

reCAPTCHA scripts are loading on every page, not just the checkout. The plugin should only load scripts on pages where CAPTCHA is active. If a caching or performance plugin is adding scripts site-wide, check its settings for script exclusion rules.

If you haven’t set up the plugin yet, the WooCommerce CAPTCHA plugin handles all of the above from a single settings panel, with no coding needed. It also supports Cloudflare Turnstile and hCaptcha if you want to test reCAPTCHA alternatives later. One install, all your WooCommerce forms covered.

Conclusion

Learning how to add Google reCAPTCHA to WooCommerce checkout is one of the fastest security improvements you can make. The setup takes under ten minutes once you have your API keys. Pick v2 if you want a simple, reliable setup. Pick v3 if you want invisible protection and are willing to tune the score limit.

The three things most stores get wrong: choosing the wrong reCAPTCHA version for their traffic, placing the CAPTCHA somewhere customers miss it, and forgetting to enable the Disable Submit Button option. Avoid those, and your checkout protection works from the moment you save settings.

For any deeper WooCommerce development help, the DevDiggers team is available.

Frequently Asked Questions(FAQs)