How To Install Google ReCAPTCHA On WordPress: A Complete Guide For Contact Form 7

If you have ever woken up to an inbox flooded with fake “SEO offers” and gibberish form submissions, you know exactly why you need reCAPTCHA. I have been building and managing WordPress sites for over ten years, and spam has always been the silent killer of productivity. It clutters your email, wastes server resources, and makes it nearly impossible to spot real leads.

The good news is that adding Google reCAPTCHA v3 to your WordPress site is one of the most effective ways to stop this. Even better, if you use Contact Form 7, the integration is built-in and surprisingly simple. You do not need to add shortcodes to your forms or touch a single line of code.

In this guide, I will walk you through the entire process based on real-world testing and setup experience. We will cover everything from generating your API keys at google.com/recaptcha to connecting them with Contact Form 7 and verifying that everything works.

Table of Contents

Why reCAPTCHA v3 Is the Right Choice for WordPress

Before jumping into the steps, let me explain why I recommend reCAPTCHA v3 over the older v2 version.

reCAPTCHA v2 is the one most people recognize. It shows that “I am not a robot” checkbox, and sometimes it makes you click on pictures of traffic lights. It works, but it adds friction. Every time a real user has to stop and prove they are human, there is a chance they will abandon the form.

reCAPTCHA v3 is completely different. It runs invisibly in the background. It watches how a visitor interacts with your site, how long they spend on the page, how they move their mouse, and assigns a score from 0.0 to 1.0. A score closer to 1.0 means the user is likely human. A low score suggests bot behavior.

For Contact Form 7 users, this is a huge advantage. Since version 5.1, Contact Form 7 has supported reCAPTCHA v3 natively. You do not need to add any [recaptcha] tags to your form templates. Once the keys are connected, protection applies automatically to every form on your site.

Here is a quick comparison to show the difference:

❮ Swipe table left/right ❯

Feature	reCAPTCHA v2	reCAPTCHA v3
User Interaction	Checkbox or image challenge	Completely invisible
User Experience	Adds friction to forms	Seamless for real users
Contact Form 7 Support	Requires extra plugins	Built-in since CF7 5.1
Spam Detection	Challenge-based	Behavior-based scoring

One important note: API keys for reCAPTCHA v3 are different from v2. If you have old v2 keys, they will not work with the v3 API. You need to register a new site specifically for v3.

Step 1: Register Your Site at Google reCAPTCHA

The first thing you need is a Google account. If you already use Gmail, Google Analytics, or Google Search Console, you can use that same account.

Head over to the Google reCAPTCHA admin console at google.com/recaptcha. Once you are signed in, look for the option to create a new site or register a new key. The interface may show a button to get started or to access the admin console.

How to Install Google reCAPTCHA on WordPress: A Complete Guide for Contact Form 7 1

Here is exactly what to do:

Click the button to create or register a new site. The wording on Google’s side changes occasionally, but you are looking for the action that lets you add a new website to reCAPTCHA.
Fill in the Label field. This is just a name to help you identify the key later. I always use something descriptive like “MySite Contact Form” or the domain name itself. If you manage multiple sites, a clear label will save you from confusion later.
Select the reCAPTCHA type. Choose reCAPTCHA v3. This is critical. If you accidentally select v2, the keys will not work with Contact Form 7’s built-in integration.
Add your domain. In the Domains field, enter your website address without https:// or www. For example, if your site is https://www.example.com, just type example.com. Google automatically covers subdomains, so you do not need to list them separately.
Accept the terms and submit. Check the box to agree to Google’s terms of service, then click the submit or create button.

After you submit, Google will immediately display two keys:

Site Key: This is public. You will paste it into WordPress.
Secret Key: This is private. You will also paste it into WordPress, but you must never share it publicly or embed it in frontend code.

How to Install Google reCAPTCHA on WordPress: A Complete Guide for Contact Form 7 2

Copy both keys and save them somewhere secure, like a password manager or a private note. You will not be able to see the Secret Key again after you leave this page, though you can generate new ones if needed.

Step 2: Connect reCAPTCHA to Contact Form 7

How to Install Google reCAPTCHA on WordPress: A Complete Guide for Contact Form 7 3

Now that you have your keys, it is time to link them to your WordPress site. This is where Contact Form 7’s built-in integration shines.

Log in to your WordPress admin dashboard. In the left-hand menu, hover over Contact and click on Integration. You will see a section titled reCAPTCHA with a button that says Setup Integration.

Click that button. Two empty fields will appear: one for the Site Key and one for the Secret Key. Paste the keys you copied from Google into these fields exactly as they appear. Then click Save Changes.

That is it. No shortcodes. No form editing. No code snippets. Contact Form 7 now automatically loads the reCAPTCHA v3 script on every page where your forms appear.

Here is a quick checklist for this step:

Go to Contact > Integration in your WordPress dashboard
Click Setup Integration under the reCAPTCHA section
Paste your Site Key into the first field
Paste your Secret Key into the second field
Click Save Changes

Step 3: Verify That reCAPTCHA Is Working

How to Install Google reCAPTCHA on WordPress: A Complete Guide for Contact Form 7 4

After saving the keys, you should verify that the integration is actually functioning. There are a few simple ways to do this.

First, visit any page on your site that has a Contact Form 7 form. Scroll to the bottom-right corner of the page. You should see a small reCAPTCHA badge that says “protected by reCAPTCHA.” If that badge is there, the script is loading correctly.

If you do not see the badge, here are the most common causes:

Incorrect keys: Double-check that you copied the full Site Key and Secret Key without extra spaces.
Wrong version: Make sure you generated v3 keys, not v2 keys.
Cache interference: Clear your WordPress cache and browser cache. Sometimes caching plugins prevent the new script from loading immediately.
Domain mismatch: Ensure the domain in your Google reCAPTCHA settings exactly matches your live site domain.

Second, submit a test message through your contact form. It should go through normally. If you want to be thorough, check your browser’s developer console for any JavaScript errors. Open the console by pressing F12, go to the Console tab, and look for red error messages related to grecaptcha or google.com.

How to Install Google reCAPTCHA on WordPress: A Complete Guide for Contact Form 7 5

Third, if you have access to server logs or want to dig deeper, you can monitor the reCAPTCHA score responses. But for most users, a successful form submission and the visible badge are enough confirmation.

Step 4: Understanding the reCAPTCHA Badge and Privacy

The reCAPTCHA v3 badge is that small floating icon in the bottom-right corner. It tells visitors that your site uses Google’s spam protection. Some site owners prefer to hide it for design reasons.

Google allows you to hide the badge, but you must include a disclaimer near your form that links to Google’s Privacy Policy and Terms of Service. This is not optional. If you hide the badge without adding the text, you violate Google’s terms.

To hide the badge, add this CSS to your site:

.grecaptcha-badge {
    visibility: hidden;
}

You can add this under Appearance > Customize > Additional CSS in your WordPress dashboard.

Then, add a notice near your contact form. Something like this works:

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Make sure the “Privacy Policy” and “Terms of Service” text links to Google’s actual pages:

https://policies.google.com/privacy
https://policies.google.com/terms

If you serve visitors from the European Union, you should also update your own site’s privacy policy to disclose that you use reCAPTCHA. Google processes certain user data to generate the risk score, and transparency is required under privacy laws like GDPR.

Step 5: Fine-Tuning and Troubleshooting

In most cases, the default settings work well right out of the box. reCAPTCHA v3 uses a default score threshold of 0.5. Submissions scoring below this are treated as spam.

However, every site is different. If you notice that some spam is still getting through, or worse, that legitimate messages are being blocked, you may need to adjust the threshold.

Here is my advice based on years of testing:

Start with the default. Do not change anything for the first week. Let reCAPTCHA learn your traffic patterns.
Monitor your inbox. Keep an eye on both spam folder entries and any complaints from users that their messages are not going through.
Adjust gradually. If you need to change the threshold, move it in small increments. Lowering it to 0.3 or 0.4 reduces false positives. Raising it above 0.5 increases security but may block real users.
Use Google’s dashboard. Log back into the reCAPTCHA admin console periodically to view score distributions. This data helps you find the sweet spot for your specific audience.

If you are still getting spam after setup, consider these additional factors:

Plugin conflicts: Some security plugins like Wordfence or Sucuri have their own firewall rules that can interfere with reCAPTCHA. If you see 403 errors or connection failures, try temporarily disabling other security plugins to isolate the issue.
JavaScript conflicts: Themes or plugins that heavily modify the page’s JavaScript can sometimes break the reCAPTCHA script. Test with a default WordPress theme like Twenty Twenty-Four to rule this out.
Mixed versions: Never use v2 and v3 keys on the same site. They are not compatible and will cause errors.

Important Changes in 2026: The Google Cloud Migration

There is one major change happening right now that every WordPress site owner should know about. Google is migrating reCAPTCHA management from the standalone admin console to Google Cloud Console.

Here is what this means for you:

Old keys may stop working. If you created reCAPTCHA keys before early 2026, they could fail when Google completes the API lockdown. There is no warning email. Your forms will just break.
New keys must be created in Google Cloud. The registration process I described above still works, but the backend infrastructure is now tied to Google Cloud projects.
The free tier is smaller. The old free tier allowed 1 million assessments per month. The new free tier allows 10,000 assessments per month. For most small business sites with a simple contact form, this is still plenty. But if you run a high-traffic e-commerce site with multiple forms, you may need to budget for the paid tier, which starts at $8 per month after the free limit.
Privacy policy updates are required. Starting April 2026, Google’s role shifts from Data Controller to Data Processor under GDPR. If you have European visitors, you must update your privacy policy to reflect this change.

If you manage multiple WordPress sites, I strongly recommend auditing all of them to ensure your reCAPTCHA keys are migrated and functioning. For agencies, using WP-CLI to batch-update keys across client sites can save hours of manual work.

Alternative: Cloudflare Turnstile

Before wrapping up, I want to mention an alternative that has gained a lot of traction in 2026. Cloudflare Turnstile is a free CAPTCHA replacement that works similarly to reCAPTCHA v3. It is invisible, privacy-friendly, and does not track users across sites.

Contact Form 7 added native support for Turnstile in version 6.1. If you are concerned about Google’s data collection practices, or if you want to avoid the new Google Cloud billing structure entirely, Turnstile is worth considering. The setup process is nearly identical: create a widget in Cloudflare’s dashboard, copy the keys, and paste them into Contact Form 7’s integration settings.

Final Thoughts

Adding reCAPTCHA v3 to your WordPress site is one of the highest-impact, lowest-effort security improvements you can make. In my experience, it cuts spam submissions by over 90 percent without annoying real visitors.

The key is to follow the setup carefully. Generate the correct v3 keys, paste them into Contact Form 7’s integration panel, verify that the badge appears, and monitor your results for a few days. If something feels off, check your keys, clear your cache, and adjust the score threshold gradually.

Spam is not going away, but with reCAPTCHA v3 and Contact Form 7, you can stop letting it run your inbox.