If your website's contact form keeps receiving nonsense messages, fake orders, or spam links, the problem usually isn't a person filling it in. It's an automated bot. Google reCAPTCHA is a free tool that checks whether a form is being submitted by a real visitor or a script, and adding it to your form is one of the most effective ways to cut that spam off at the source.
What reCAPTCHA Does
reCAPTCHA sits between your visitor and your form's submit button. Depending on the version you choose, it either asks the visitor to tick a box confirming they're not a robot, or it runs invisibly in the background and scores how human-like their behavior looks. Submissions that fail the check are blocked before they ever reach your inbox or database.
Step 1: Get Your reCAPTCHA Keys from Google
Before you can add reCAPTCHA to your website, you need a site key and a secret key from Google.
- Go to the Google reCAPTCHA admin console and sign in with a Google account.
- Click + or Register a new site.
- Give the site a label, such as your business name.
- Choose a reCAPTCHA type. reCAPTCHA v2 ("I'm not a robot" checkbox) is the simplest to set up and works well for most small business contact forms. reCAPTCHA v3 runs invisibly with no checkbox but requires a bit more configuration to interpret its score.
- Enter your website's domain (without http:// or https://).
- Accept the terms of service and click Submit.
- Copy the Site Key and Secret Key that appear. You'll need both in the next step.
Keep your Secret Key private. It should only ever be used in your website's backend code or plugin settings, never displayed on the page itself.
Step 2: Add reCAPTCHA to Your Form
If You Use WordPress
Most WordPress contact form plugins (such as the ones powering Contact Form 7, WPForms, or Ninja Forms) have built-in reCAPTCHA support, so you don't need to touch any code.
- Log in to your WordPress admin dashboard.
- Open your contact form plugin's settings, usually under a menu named after the plugin (e.g. Contact or WPForms).
- Look for an Integrations or reCAPTCHA settings tab.
- Paste your Site Key and Secret Key into the matching fields.
- Save the settings, then open the form you want protected and make sure the reCAPTCHA field or option is enabled for it.
If You Use a Custom HTML or PHP Contact Form
If your website doesn't run on WordPress, you'll add a small snippet of code manually.
- Add Google's reCAPTCHA script tag to the <head> section of the page containing your form.
- Insert the reCAPTCHA widget div, with your Site Key, inside the <form> tags near the submit button.
- On the server side (the script that processes your form, typically a PHP file), add a verification request that sends the submitted reCAPTCHA response and your Secret Key to Google's verification endpoint before processing the form.
- Only send the form's email or save its data if Google's response confirms the check passed.
If you're not comfortable editing your site's code directly, this is a good task to hand to whoever built or maintains your website.
Testing Your Setup
- Open your website in a private or incognito browser window and confirm the reCAPTCHA checkbox or badge appears on the form.
- Submit a test message and confirm it still comes through to you normally.
- Check back after a few days to see whether spam submissions have dropped.
If reCAPTCHA doesn't appear at all, clear your website's cache (and any caching plugin's cache, if you use one) and reload the page. A cached version of the form may still be missing the new code.
If you're also dealing with contact form messages landing in your spam folder rather than your inbox, that's usually a separate email deliverability issue. See How to Stop Your Website's Contact Form Emails From Going to Spam for how to fix that.