reCAPTCHA v3 setup
Add Google reCAPTCHA v3 to your forms, and what it means for privacy.
reCAPTCHA v3 is optional and disabled until you provide keys. Work through the other spam layers first — most sites do not need this.
Get keys
- Go to
google.com/recaptcha/admin. - Register a site and choose reCAPTCHA v3.
- Add your domain.
- Copy the Site key and Secret key.
Make sure you pick v3. Keys from v2 will not work.
Configure
In Sense Forms → Settings, paste both keys and set the Score threshold.
Google returns a score from 0.0 to 1.0, where 1.0 is confidently human. Submissions below your threshold are rejected.
| Threshold | Effect |
|---|---|
| 0.3 | Lenient — blocks only obvious bots |
| 0.5 | Balanced, and the usual starting point |
| 0.7 | Strict — will reject some real people |
Start at 0.5 and adjust based on what actually happens. Raising it above 0.7 reliably costs you genuine submissions, and the people most likely to score low are those on VPNs, privacy-focused browsers, or older devices.
Verification is server-side
The visitor’s token is verified with Google’s siteverify API when the form is submitted, not in the browser. A forged score cannot be passed by editing the page.
Privacy implications
With reCAPTCHA enabled:
- Google’s script loads on every page containing a form
- The visitor’s IP address and token are sent to Google on submission
- Google’s terms and privacy policy apply to that data
This is a genuine data transfer to a third party. Under GDPR you must disclose it in your privacy policy, and you should consider whether you have a lawful basis for it.
With reCAPTCHA disabled, Sense Forms makes no external requests whatsoever.
If it blocks real people
Lower the threshold first — 0.5 to 0.3 usually resolves it. If legitimate submissions are still rejected, turn reCAPTCHA off and rely on the honeypot, time trap and Akismet instead. Losing real enquiries costs more than the spam it prevents.