![\"reCAPTCHA](\"https:\/\/www.swiftcommerce.io\/help\/wp-content\/uploads\/2025\/12\/clipboard-8.jpeg\")
<\/figure>\n\n\n\n- \n
- Enable reCAPTCHA in Swift Commerce \u2192 Security & Privacy \u2192 reCAPTCHA.<\/li>\n\n\n\n
- In Setup<\/strong>, choose a CAPTCHA Provider. Register the exact site domain with that provider and copy its site and secret keys into the matching fields. Keep secret keys private.<\/li>\n\n\n\n
- Open Protection<\/strong> and select the forms to protect. Save Changes, then test each selected form while signed out.<\/li>\n<\/ul>\n\n\n\n
Setup: provider and keys<\/h2>\n\n\n\n
Google reCAPTCHA (Free)<\/h3>\n\n\n\n
Choose v2<\/strong> for a checkbox or invisible challenge, or v3<\/strong> for a background score. Each version requires keys created for that same version. v3 includes a score threshold: lower values are more permissive; raise it if unwanted submissions pass, or lower it if legitimate submissions fail. Choose whether to show the v3 badge or display Google attribution beside protected forms when hidden.<\/p>\n\n\n\n
Turnstile or hCaptcha (Pro)<\/h3>\n\n\n\n
Choose Cloudflare Turnstile or hCaptcha, enter that provider\u2019s site and secret keys, then choose the supported widget mode. Turnstile offers always visible, execute, or interaction-only modes. hCaptcha offers visible checkbox or invisible mode. Keys from one provider cannot be used for another.<\/p>\n\n\n\n
Protection: forms and exceptions<\/h2>\n\n\n\n
Select the forms that need CAPTCHA: WordPress Login, WordPress Registration, Lost Password, WooCommerce Login, WooCommerce Registration, Checkout Page,<\/strong> and Comment Forms<\/strong>. Pro also offers Add Payment Method<\/strong> and Product Reviews<\/strong>. WooCommerce surfaces only apply when WooCommerce and the relevant form are available.<\/p>\n\n\n\n
Pro adds Widget appearance<\/strong> (light\/dark theme and normal\/compact size for supported widgets), an IP whitelist<\/strong> (one IP address, CIDR range or supported start\u2013end range per line), and Role bypass<\/strong>. Role bypass affects logged-in users only; it does not exempt anonymous visitors at login or registration.<\/p>\n\n\n\n
Analytics (Pro)<\/h2>\n\n\n\n
In Protection \u2192 Verification analytics<\/strong>, turn on collection if you need reporting; it is off by default. The dashboard stores IP addresses as one-way fingerprints and does not store browser user-agent strings. Set retention to 1\u2013365 days; a scheduled cleanup removes expired records. The Analytics<\/strong> tab shows daily results, results by form, clients with failed checks, and recent failures. When collection is off or there are no checks, the report shows an explicit empty state.<\/p>\n\n\n\n
Test and troubleshoot<\/h2>\n\n\n\n
- \n
- Use a private browser window to submit each protected form. Verify that the chosen provider loads and a legitimate submission completes.<\/li>\n\n\n\n
- If a widget does not load, confirm the site domain, provider, version, and matching site\/secret keys. Check for script blocking or caching on the protected page.<\/li>\n\n\n\n
- If legitimate traffic is blocked by v3, review the threshold and analytics before changing it. If a whitelisted IP or exempt role bypasses a check, confirm that the exception is intentional.<\/li>\n\n\n\n
- After switching providers, re-test all selected forms; each provider uses different keys and widget behavior.<\/li>\n<\/ul>\n\n\n\n
Free and Pro<\/h2>\n\n\n\n\n\n
Free:<\/strong> Google reCAPTCHA v2\/v3 and the seven core forms. Pro:<\/strong> Turnstile, hCaptcha, two additional WooCommerce forms, widget appearance, IP and role exceptions, and optional verification analytics.<\/p>\n\n\n\n\n\n\n\n
Questions about protection and account access<\/h2>\n\n\n\n
Does CAPTCHA also verify a customer’s email address?<\/strong> No. A CAPTCHA checks a form submission; it does not confirm access to an inbox or approve an account. Configure Registration & Access<\/a> separately if new accounts must verify their email or wait for a review.<\/p>\n\n\n\n
Can I choose a different provider for each form?<\/strong> No. The selected provider is shared by the forms enabled in Protection. Changing providers requires the new provider’s matching keys and a fresh test of every selected form.<\/p>\n\n\n\n
Does role bypass exempt a customer before they log in?<\/strong> No. Role checks apply only to an already signed-in user. An IP whitelist can bypass verification regardless of the visitor’s role, so test from an address outside your whitelist when checking login or registration protection.<\/p>\n\n\n\n
Does a passed check mean the visitor is definitely human?<\/strong> No. It records the outcome of the provider’s verification. Analytics are not proof of a person’s identity, a successful purchase or inbox ownership.<\/p>\n\n\n\n
Follow a form-specific tutorial<\/h2>\n\n\n\n
For the WordPress login screen, follow the Google reCAPTCHA login guide<\/a>, Turnstile login guide<\/a> or hCaptcha login guide<\/a>. To protect the customer signup form on My Account, use the Turnstile WooCommerce registration guide<\/a>.<\/p>\n\n\n\n
- Open Protection<\/strong> and select the forms to protect. Save Changes, then test each selected form while signed out.<\/li>\n<\/ul>\n\n\n\n