Kadence reCAPTCHA

The public forms you never designed

You look after your contact page, but your site has other forms open to anyone. WordPress ships with the login, lost password, registration and comment forms. If you sell with WooCommerce, the checkout and review forms join them. Nobody drew them into your project, so it is easy to forget that a program can fill them in too.

That is why it pays to take inventory before choosing a verification type: each form is used by a different audience and deserves its own decision. Kadence reCAPTCHA gathers that decision on one screen. You add your keys once and tick where you want the check.

Its goal is to curb spam and automated submissions, including brute-force attempts. It works with Google reCAPTCHA and also with Cloudflare Turnstile, depending on the service you prefer to use.

Six points switched on one at a time

The Form Settings tab lets you turn the check on separately in these places:

• Comments on posts and pages.
• Login forms.
• Lost password forms.
• Registration forms.
• WooCommerce checkout.
• WooCommerce reviews.

Three ways to check who is visiting

reCAPTCHA v2 asks for a direct test, such as ticking a box or clicking on images. This version and v3 let you choose the service address, google.com or recaptcha.net, an option that can affect performance and reliability depending on your visitors' network.

reCAPTCHA v3 runs in the background, with no action from the person, and assigns a score from 0.0 to 1.0. The closer to 1.0, the more legitimate the traffic looks; the closer to 0.0, the more likely it is a bot. You set the threshold, and it is worth reviewing it with real submissions so you do not reject your visitors.

Cloudflare Turnstile offers three widget modes: Managed, Non-interactive and Invisible. In addition, optional pre-clearance recognizes people who already passed verification on later visits.

The look can be adjusted too: light or dark theme and left, center or right alignment. In reCAPTCHA you can force a language for the test; if you leave it empty, it comes from the user's local settings.

Forms and risks outside this layer

The list of six points marks its reach. If your main form belongs to another plugin and is not on that list, check it before counting on this protection. The form blocks in Kadence Blocks have their own reCAPTCHA setting, where the block's keys are entered.

It also does not replace a security plugin. Its features do not include two-factor authentication or IP address blocking, and a passed check only says the service accepted the visitor. A person sending spam by hand can get through.

The service keys and your first check

You need an account with the chosen service, your site's domain and WooCommerce if you will protect checkout or reviews. With that ready, follow these steps:

1. Register your site in the Google panel or in Cloudflare's Turnstile tab and save the Site Key and Secret Key.
2. In WordPress, go to Settings and then CAPTCHA, and open the API Keys tab.
3. Choose Google v2, Google v3 or Turnstile under CAPTCHA Type.
4. Paste the keys, click Verify and save.
5. Open Form Settings and tick the forms you want to protect.
6. Run a real test on each enabled form while logged out, including checkout if you sell.

When your problem sits somewhere else

If the main risk is in the store, reCaptcha for WooCommerce covers fourteen points, among them paying for pending orders and the add payment method form. It supports Turnstile and hCaptcha, plus a hybrid v2 and v3 mode.

If logins worry you more than spam, Loginizer Pro limits attempts, offers two-factor authentication and can disable or rename XML-RPC.

Decisions before you switch it on

Can I use v2 on one form and v3 on another?

The API Keys screen sets a single CAPTCHA type, and Form Settings decides which forms it applies to.

Does it only work with Google?

It also works with Cloudflare Turnstile. You choose the service under CAPTCHA Type and use that provider's keys.

Will the visitor always see a test?

It depends on the method. v2 asks for a direct action, v3 works in the background and Turnstile has an invisible mode.