How to Add Google reCAPTCHA to WooCommerce Checkout

Adding Google reCAPTCHA to your WooCommerce checkout takes about ten minutes. You need two things before you touch any plugin: a Google account and a free key pair from the reCAPTCHA admin console. This guide on how to add Google reCAPTCHA to WooCommerce checkout starts with those keys.

Getting reCAPTCHA right means choosing the right version and placing it where customers will see it. Those details matter more than the install itself. We checked every step against Google’s reCAPTCHA docs and WooCommerce’s Store API docs in October 2026.

You’ll learn which reCAPTCHA version to pick and how to generate your API keys. Then you’ll set everything up with the WooCommerce Advanced CAPTCHA plugin, built by DevDiggers.

Why Your WooCommerce Checkout Needs reCAPTCHA

Card testing is the attack a checkout CAPTCHA stops best. Stripe defines card testing as fraud that checks whether stolen card details are valid. Testers run scripts that try many cards at once with small payments. Stripe lists disputes, higher decline rates and extra fees among the results.

Here’s what those attacks look like in practice: a bot hits your checkout, submits dozens or hundreds of small orders using stolen card numbers to test which ones are active. It then moves on. You’re left with failed orders, gateway fees, and sometimes a flagged PayPal or Stripe account.

Knowing how to add Google reCAPTCHA to WooCommerce checkout and doing it correctly stops most automated bots from getting that far. It’s not a complete fraud solution on its own, but it removes the easiest path in.

More on what reCAPTCHA can and can’t stop in a moment.

reCAPTCHA v2 vs v3: Which One Should You Use?

Use reCAPTCHA v2 Checkbox for most WooCommerce stores. It shows a clear “I’m not a robot” check and needs no score tuning. reCAPTCHA v3 runs in the background and returns a score from 0.0 to 1.0. Your plugin then has to decide which scores to block.

	reCAPTCHA v2 Checkbox	reCAPTCHA v2 Invisible	reCAPTCHA v3
User sees it?	Yes, “I’m not a robot” box	Only if suspicious	Never
User interaction	One click (sometimes image challenge)	None unless activated	None
How it works	verification-based	Background analysis with a challenge if marked	Risk score (0.0 to 1.0)
False positives	Low	Low	Requires limit adjustment
Setup complexity	Simple	Simple	Needs server-side score handling
Best for checkout?	Yes most stores	Yes lower difficulty	Use carefully; needs tuning

For most WooCommerce stores, v2 Checkbox is the safest starting point. It’s easy to set up and customers understand what they need to do. The one-click difficulty is small compared to the protection it adds.

Another common change is to add WooCommerce checkout fields such as a gift message.

reCAPTCHA v3 is more invisible but needs work to use correctly. It returns a score between 0.0 (likely a bot) and 1.0 (likely human). You set the threshold. Google suggests 0.5 as a starting point. That may be too strict or too relaxed for your traffic. If you set it wrong, you either miss bots or block real customers. Worth the setup if you run a high-traffic store and want a smooth experience. Not worth it if you just want checkout protection up and running today.

Important: The WooCommerce Anti-Fraud documentation says its checkout CAPTCHA supports only reCAPTCHA v2. It explains that v3 returns a background risk score that needs separate threshold logic. Its suggested lighter option is Cloudflare Turnstile.

A Note on reCAPTCHA and the WooCommerce Block Checkout

Worth knowing before you go further.

reCAPTCHA protects the front-end checkout form. But in late 2024, card-testing bots started hitting the WooCommerce Store API and skipped the checkout page entirely. The WooCommerce Developer Blog covered this in December 2024, noting that bots targeting the Store API don’t interact with the form at all. Front-end CAPTCHA never fires.

If your store uses the block checkout, also turn on WooCommerce’s built-in rate limiting. Go to WooCommerce > Settings > Advanced > Features and enable Rate limiting Checkout block and Store API. The Store API docs say it allows 3 checkout requests per 60 seconds as of October 2026.

WooCommerce Advanced CAPTCHA also checks the CAPTCHA token inside the block checkout’s Store API request. With checkout protection on, a request to /wc/store/v1/checkout without a valid token is rejected. Cloudflare or your hosting firewall can add a further layer.

For most stores on classic checkout, reCAPTCHA alone is a strong first layer. If you’re on Block Checkout and seeing REST API-based attacks, add rate limiting too.

How to Get Your Google reCAPTCHA API Keys

You need a Site Key and a Site Secret before anything else. Both come from the reCAPTCHA admin console. Google now links every key to a Google Cloud project. The free tier covers 10,000 assessments a month. Here’s how to get the keys without the common mistakes.

Step 1: Open the Google reCAPTCHA Admin Console

Go to google.com/recaptcha/admin/create and sign in with your Google account. Google stopped issuing new classic keys in 2024. Its migration guide says keys now belong to a Google Cloud project and existing keys keep working without code changes.

Step 2: Fill In Your Site Details

1. Add a label (anything descriptive, like your store name). Then choose your reCAPTCHA type. Select reCAPTCHA v2 if you want the checkbox, or reCAPTCHA v3 if you want invisible scoring.
2. Enter your domain in the domains field. Two common mistakes here: don’t include https:// and don’t add a trailing slash. Just the bare domain for example, yourstore.com.
3. Click Submit.

Step 3: Copy Your Site Key and Site Secret

After submitting, Google shows you both keys. Copy them somewhere safe. You’ll paste them into the plugin in a moment.

How to Add Google reCAPTCHA to WooCommerce Checkout

The WooCommerce Advanced CAPTCHA plugin handles reCAPTCHA, Cloudflare Turnstile and hCaptcha from one settings panel. The steps below cover the Google reCAPTCHA setup specifically.

If you’re not sure the plugin is right for you, it supports all standard WooCommerce forms (checkout, login, registration, password reset and product reviews), plus Contact Form 7. One plugin, one settings page, all your forms covered.

Step 1: Install and Activate the Plugin

1. From your WordPress dashboard, go to Plugins > Add Plugin and click Upload Plugin.
   
2. Upload the WooCommerce Advanced CAPTCHA plugin zip file that you’ve purchased.
   
3. Click Install Now. Then click Activate Plugin.
   

Step 2: Set up General Settings

1. Go to DevDiggers Plugins > Advanced CAPTCHA.
   
2. In the General tab, toggle the plugin on.
   
3. Select Google reCAPTCHA in the CAPTCHA Type section.
   
4. Add your IP address to Whitelisted IPs if you place test orders regularly.
   
5. Click Save Changes.
   

Step 3: Set up Forms Settings

1. Switch to the Forms tab.
   
2. Under WooCommerce Forms, select both All Users Checkout and Guest Checkout Only. Together they cover logged-in and guest checkouts.
   
3. Then set the CAPTCHA Position for the WooCommerce Checkout Form. Placing it just above the “Place Order” button gets the best visibility, as customers see it right before they click.
   
4. Click Save Changes.
   

Step 4: Add Your reCAPTCHA Keys

1. Switch to the Google reCAPTCHA tab.
   
2. Select your Version: V2 Checkbox, V2 Invisible or V3. Match this to whichever type you registered in the admin console.
   
3. Select your preferred Size (Normal or Compact) and Theme (Light or Dark) if you chose v2. These are cosmetic options. Pick what fits your store design.
   
4. If you chose v3, set the Minimum Score. Start with 0.5. If you see real customers getting blocked, lower it to 0.3. If bots are still getting through, raise it to 0.7 and monitor.
   
5. Paste your Site Key and Site Secret into the fields.
   
6. Click Save Changes.
   

Step 5: Test the Setup

1. Open an incognito browser window and add a product to your cart.
   
2. Then, go to checkout.
   
3. If you set up v2, you’ll see the “I’m not a robot” checkbox. If you set up v3, you’ll see the reCAPTCHA badge in the bottom-right corner.
   

Always test in incognito. If your IP is whitelisted or your user role is excluded in the plugin settings, you won’t see the CAPTCHA when logged in as admin. Testing incognito gives you the same view a real customer gets.

Quick Troubleshooting

reCAPTCHA isn’t showing on checkout. First, check you’re in incognito and not logged in as admin. Then confirm the plugin is enabled, the CAPTCHA type is set to Google reCAPTCHA, and the WooCommerce checkout form is selected under Forms settings. Also, check that no caching plugin is serving an old version of the page. If it is, clear your cache after setup.

The submit button still works without completing reCAPTCHA. Go back to the Google reCAPTCHA configuration tab and enable Disable Submit Button. That option must be turned on manually and works with V2 Checkbox only.

reCAPTCHA scripts are loading on every page instead of only the checkout. The plugin should only load scripts on pages where CAPTCHA is active. If a caching or performance plugin is adding scripts site-wide, check its settings for script exclusion rules.

If you haven’t set up the plugin yet, the WooCommerce CAPTCHA plugin handles all of the above from a single settings panel, with no coding needed. It also supports Cloudflare Turnstile and hCaptcha if you want to test reCAPTCHA alternatives later. To compare plugins first, see our roundup of the best WooCommerce CAPTCHA plugins. One install, all your WooCommerce forms covered.

Conclusion

Learning how to add Google reCAPTCHA to WooCommerce checkout is one of the fastest security improvements you can make. The setup takes under ten minutes once you have your API keys. Pick v2 if you want a simple, reliable setup. Pick v3 if you want invisible protection and are willing to tune the score limit.

The three things most stores get wrong: choosing the wrong reCAPTCHA version for their traffic, placing the CAPTCHA somewhere customers miss it, and forgetting to enable the Disable Submit Button option. Avoid those, and your checkout protection works from the moment you save settings.

For any deeper WooCommerce development help, the DevDiggers team is available.

Frequently Asked Questions (FAQs)