Setting up reCAPTCHA (v2 & v3)

Updated Oct 17, 2026 Trust & Compliance

TitanCart ships with built-in Google reCAPTCHA protection for the storefront forms bots like to hit: customer login, registration, guest checkout and product reviews. It is part of the core plugin, in TitanCart Lite as well as Pro, with nothing extra to buy. You choose between reCAPTCHA v2 (the “I’m not a robot” checkbox) and reCAPTCHA v3 (invisible; Google scores each submission in the background). This guide covers getting keys from Google, switching the extension on, picking the forms to protect, and checking it works.

Note: reCAPTCHA only guards the storefront. The WordPress admin login (wp-login.php for you and your staff) is never affected, so you cannot lock yourself out of the dashboard.

1. Get your keys from Google

Every reCAPTCHA site has a matching pair of keys: a Site key (public, used on the page) and a Secret key (private, used by your server to verify each token). v2 and v3 use different pairs that are not interchangeable.

Sign in at google.com/recaptcha/admin and register a new site.
Give it a label you will recognise, and choose the type: v2 → “I’m not a robot” Checkbox, or v3.
Under Domains add your storefront domain — and the www form and any staging domain you test on.
Submit. Google shows the Site key and Secret key; keep the tab open.

Tip: register the site twice, once as v2 and once as v3, if you may switch later. TitanCart stores both pairs and uses only the one that matches the version you select.

2. Enable the extension

Go to TitanCart → Extensions → Installed Extensions, find Google reCAPTCHA in the Built-in Extensions card, make sure it is enabled, and click the gear icon to open its settings page. Enabling it does nothing on its own: the extension stays dormant until the keys for your chosen version are filled in, so there is no risk of a broken widget while you set up.

3. Choose a version and paste the keys

The settings page has four sections: Mode, reCAPTCHA v2 Settings, reCAPTCHA v3 Settings and Protected Forms.

Under Mode, set reCAPTCHA version to v2 (checkbox widget) or v3 (invisible, score-based). v2 is the default.
For v2, paste the Site key and Secret key into the v2 section and optionally choose the widget Theme (Light or Dark) and Size (Normal or Compact).
For v3, paste the v3 Site key and v3 Secret key into the v3 section and pick the v3 success score (next step).

Save. Only the section matching the selected version is read; the other can stay blank.

4. Set the v3 success score

v3 never challenges the visitor. Google returns a score from 0.0 to 1.0 for each submission — higher means more likely human — and TitanCart rejects the submission when the score is below your threshold. The v3 success score dropdown offers 0.9 (strict), 0.7, 0.5 (recommended), 0.3 and 0.1 (permissive). Start at 0.5; lower it if real customers report being blocked, raise it if spam still gets through. TitanCart also checks that the token was issued for the right form, so a token captured on the login page cannot be replayed on checkout.

5. Choose which forms to protect

Each form under Protected Forms has its own switch:

Login form — on by default. The customer login on the My Account page.
Registration form — on by default. New-customer sign-up.
Checkout (guest) — off by default. Applies to guest orders only; signed-in customers are never challenged. A CAPTCHA at checkout costs sales, so turn it on only if bot orders are a real problem.
Review form — on by default. The product-review form (see Product reviews).
Contact form — on by default, but TitanCart has no built-in contact form; this switch only takes effect on a theme contact form that opts into TitanCart’s reCAPTCHA field hook.

Google’s script is loaded only on pages that actually show a protected form, so the rest of the store does not carry it.

6. Test it

Open the storefront in a private window so you are logged out, and go to the My Account page.
v2: the “I’m not a robot” checkbox appears under the login and registration forms. Tick it and submit; the form should go through.
v3: nothing visible except Google’s small badge in the page corner. Submit normally; a real submission goes through.

A blocked submission shows “reCAPTCHA verification failed. Please try again.” on the form.

How to verify on Google’s side

The reCAPTCHA admin console is the source of truth for whether tokens reach Google and how your traffic scores. Open your site there and check the Domains list — a missing live domain is the single most common cause of “it always blocks me”. After some real traffic, the analytics show request volume and, for v3, the score distribution; if most legitimate traffic scores 0.7–0.9, a 0.5 threshold is comfortable. Confirm the key type matches the version selected in TitanCart: Google rejects a v2 key used as v3 and vice versa.

Troubleshooting

The widget (v2) or badge (v3) never appears. The selected version is missing a key. The extension stays dormant until both keys for that version are filled in.
Everyone is blocked, even real people. The storefront domain is not in the Domains list in Google’s console, the wrong key pair is in use for the selected version, or the v3 score threshold is too high. Check the Domains list first.
“reCAPTCHA verification failed” during a network hiccup. Verification is fail-closed: if TitanCart cannot reach Google within eight seconds, the submission is rejected rather than waved through. Retrying usually works.
I enabled the Contact form and nothing shows. There is no built-in contact form; the switch waits for a theme that uses the hook.
No CAPTCHA on the WordPress admin login. Intended. Only the storefront forms are protected.
Forms broke after switching v2 to v3 (or back). The version you switched to has no keys yet; the two versions read separate fields.