reCaptcha for WooCommerce
Antivirus scan
Powered by ClamAV
✅ Verified clean
This product file has passed our security filters.
Want to run a fresh ClamAV scan right now? Takes a few seconds and shows scanner version, signature DB and live result.
This can take 5 to 30 seconds.
Clean file Threat detected
No threats detected in this file.
- File
- Size
- Scanned
- ClamAV
- Signature database
⚡ Powered by ClamAV
Scan could not be completed
Report product
If you detected an issue (broken file, malware, inappropriate content, etc.) let us know and we'll review it ASAP.
Sign in to report
About reCaptcha for WooCommerce
Nobody needs to rob your shop: they use its checkout to test cards
One day dozens of low-value orders appear, with meaningless names and emails, almost all with the payment declined. It is not a gateway fault. It is card testing: someone with stolen card details uses your payment form, with scripts, to find out which cards are still valid.
They take nothing, and it still costs you. You are left with the disputes for the charges that went through, the fees and a decline rate that makes legitimate purchases look suspicious too, even once the attack is over.
reCaptcha for WooCommerce, by I13 Web Solution, puts a verification at each of those points: guest and logged-in checkout, paying for a pending order and the add payment method form. That last one is the preferred route for testing cards, because those validations do not usually appear on the cardholder's statement.
Where it puts the verification
- Checkout, as a guest and logged in, on both the classic checkout and the checkout block.
- Payment methods and pending orders: add payment method and pay for order.
- WooCommerce accounts: registration, login and password recovery.
- WordPress: wp-login login, registration and lost password, plus comments.
- Other forms: product reviews, order tracking and Jetpack forms.
Each of the fourteen points is turned on separately.
Three verification services and two ways of asking
Google reCAPTCHA, classic or Enterprise, with v2, the checkbox, or v3, invisible. Hybrid mode uses v3 and only shows the v2 checkbox if v3 fails, so a real customer is not blocked.
Cloudflare Turnstile, in checkbox or hidden mode, and hCaptcha.
Customisation: your own label and error messages, light or dark theme, full or compact size and v2 language based on the user. Verification can be turned off for an IP or a range.
A captcha on the door does not close the window
The alternative routes. Verification has to be required on every request that validates a card or creates a payment. That is why it has options to block the checkout REST endpoint and the registration ones, and to reject orders from an unknown origin. Use the latter only if all your orders record their origin, or you will reject good orders.
It is not an anti-fraud tool. It does not score orders or decide whether a purchase is suspicious. It stops scripts, but a determined attack changes IP and technique. What works is combining the captcha with attempt limits and your gateway's rules.
It depends on an external service. You need keys from Google, Cloudflare or hCaptcha, and that service is what performs the check.
Getting reCaptcha for WooCommerce running: requirements and first steps
PHP 7.4, WordPress 3.0 or later and WooCommerce 5.0 or later.
- Create keys for the service you will use: reCAPTCHA v2 or v3, Turnstile or hCaptcha.
- In WooCommerce, Settings, reCaptcha, enter the site key and the secret key, and choose the version.
- Turn on verification for guest and logged-in checkout, add payment method and pay for order.
- If you do not use a gateway that redirects away, such as PayPal Standard, set the captcha validity to 0.
- With the checkout block, enable the captcha block and place it above the payment button.
Other shop defences in the catalogue
For the part a captcha does not cover, Anti-Fraud for WooCommerce combines order and customer checks into a risk score, and can assess the checkout before the payment is taken.
If you want the same inside a login plugin, Login Security Pro adds reCAPTCHA or Turnstile to WooCommerce login, registration and checkout. And to protect the whole site, Security Ninja PRO combines a cloud firewall, login protection, a scanner and an activity log.
Questions about reCaptcha for WooCommerce
Does it work with the checkout block?
Yes, with both the classic checkout and the checkout block.
Does it bother customers?
With reCAPTCHA v3 or Turnstile in hidden mode no checkbox appears. Hybrid mode only shows the v2 one when v3 fails.
Does it stop card testing completely?
Not on its own. It stops scripts, but it is worth combining with attempt limits and your gateway's rules.
Does it protect forms outside WooCommerce?
The WordPress login, registration and password forms, comments and Jetpack forms.
Topics
Version history
-
v
2.83 Current 30 Oct 2026
-
v
2.82 7 Oct 2026
-
v
2.80 12 Aug 2026
-
v
2.73 25 Feb 2026
Customer reviews
Sign in to leave a review. Only people who have the product can review it.
No reviews for this product yet.
Frequently asked questions
-
GPL (General Public License) is the license under which WordPress and most premium plugins/themes are distributed. It grants you the right to use, modify and redistribute the software in as many projects as you want, with no domain restrictions.
-
Yes. With membership you get automatic updates via our GPLClub Updater plugin (installed on your WP, detects new versions and applies them). With individual purchase, you get one year of manual updates from your account.
-
Depends on the plan. Monthly: 3 domains. Semi-annual: 7. Annual and Lifetime: 15. Individual purchase: 1 domain.
-
GPLClub offers its own support for installation, configuration and compatibility. For direct support from the original author (feature requests, product-specific bugs), a license purchased from the author is required.
