In this guide

Explore the steps and reference sections below.

Start reading
On this page

Protect selected WordPress and WooCommerce forms from automated submissions. Free supports Google reCAPTCHA; Pro adds Cloudflare Turnstile and hCaptcha, more protected forms, exemptions, and optional verification analytics.

Set up protection

reCAPTCHA setup screen showing provider selection and protection sections
  • Enable reCAPTCHA in Swift Commerce → Security & Privacy → reCAPTCHA.
  • In Setup, choose a CAPTCHA Provider. Register the exact site domain with that provider and copy its site and secret keys into the matching fields. Keep secret keys private.
  • Open Protection and select the forms to protect. Save Changes, then test each selected form while signed out.

Setup: provider and keys

Google reCAPTCHA (Free)

Choose v2 for a checkbox or invisible challenge, or v3 for a background score. Each version requires keys created for that same version. v3 includes a score threshold: lower values are more permissive; raise it if unwanted submissions pass, or lower it if legitimate submissions fail. Choose whether to show the v3 badge or display Google attribution beside protected forms when hidden.

Turnstile or hCaptcha (Pro)

Choose Cloudflare Turnstile or hCaptcha, enter that provider’s site and secret keys, then choose the supported widget mode. Turnstile offers always visible, execute, or interaction-only modes. hCaptcha offers visible checkbox or invisible mode. Keys from one provider cannot be used for another.

Protection: forms and exceptions

Select the forms that need CAPTCHA: WordPress Login, WordPress Registration, Lost Password, WooCommerce Login, WooCommerce Registration, Checkout Page, and Comment Forms. Pro also offers Add Payment Method and Product Reviews. WooCommerce surfaces only apply when WooCommerce and the relevant form are available.

Pro adds Widget appearance (light/dark theme and normal/compact size for supported widgets), an IP whitelist (one IP address, CIDR range or supported start–end range per line), and Role bypass. Role bypass affects logged-in users only; it does not exempt anonymous visitors at login or registration.

Analytics (Pro)

In Protection → Verification analytics, turn on collection if you need reporting; it is off by default. The dashboard stores IP addresses as one-way fingerprints and does not store browser user-agent strings. Set retention to 1–365 days; a scheduled cleanup removes expired records. The Analytics tab shows daily results, results by form, clients with failed checks, and recent failures. When collection is off or there are no checks, the report shows an explicit empty state.

Test and troubleshoot

  • Use a private browser window to submit each protected form. Verify that the chosen provider loads and a legitimate submission completes.
  • If a widget does not load, confirm the site domain, provider, version, and matching site/secret keys. Check for script blocking or caching on the protected page.
  • If legitimate traffic is blocked by v3, review the threshold and analytics before changing it. If a whitelisted IP or exempt role bypasses a check, confirm that the exception is intentional.
  • After switching providers, re-test all selected forms; each provider uses different keys and widget behavior.

Free and Pro

Free: Google reCAPTCHA v2/v3 and the seven core forms. Pro: Turnstile, hCaptcha, two additional WooCommerce forms, widget appearance, IP and role exceptions, and optional verification analytics.

Questions about protection and account access

Does CAPTCHA also verify a customer’s email address? No. A CAPTCHA checks a form submission; it does not confirm access to an inbox or approve an account. Configure Registration & Access separately if new accounts must verify their email or wait for a review.

Can I choose a different provider for each form? No. The selected provider is shared by the forms enabled in Protection. Changing providers requires the new provider’s matching keys and a fresh test of every selected form.

Does role bypass exempt a customer before they log in? No. Role checks apply only to an already signed-in user. An IP whitelist can bypass verification regardless of the visitor’s role, so test from an address outside your whitelist when checking login or registration protection.

Does a passed check mean the visitor is definitely human? No. It records the outcome of the provider’s verification. Analytics are not proof of a person’s identity, a successful purchase or inbox ownership.

Follow a form-specific tutorial

For the WordPress login screen, follow the Google reCAPTCHA login guide, Turnstile login guide or hCaptcha login guide. To protect the customer signup form on My Account, use the Turnstile WooCommerce registration guide.