How To Create Google reCAPTCHA V3 Keys

Google reCAPTCHA v3 keys are now created in the Google Cloud console, not the old standalone reCAPTCHA admin page. Google moved key management to Google Cloud at the end of 2025, and keys created outside a Cloud project stopped being supported in early 2026. The process still takes about ten minutes and is still free for most sites (10,000 assessments a month), but the screens have changed and there are a few traps that did not exist before.

This guide walks through creating a v3 site key and secret key the current way, migrating an old “classic” key if you have one, choosing between v3 and v2, and wiring the keys into WordPress forms, login and registration without locking yourself out.

What changed with reCAPTCHA in 2025 and 2026

For years you went to google.com/recaptcha/admin, clicked the plus button, picked v2 or v3, added a domain and copied two keys. That console is now a legacy view. Through late 2025 Google asked everyone to migrate their classic keys into a Google Cloud project, offered an opt-in automatic migration in Q4 2025, and from Q1 2026 onward new keys are created and managed only under Google Cloud.

Three things matter for a WordPress site owner:

• Existing keys keep working after migration. The site key and secret key do not change, and you do not need to touch your plugin settings. Just do not delete the classic key from either console, because that removes it everywhere and your forms lose protection immediately.
• The free tier is 10,000 assessments per month, where an assessment is one token verification. The old limit was one million. A small business site will not get near 10,000; a busy membership or community site with reCAPTCHA on login, registration and comments can.
• Above 10,000 you need billing enabled on the Cloud project. The Standard tier is a flat $8 per month for up to 100,000 assessments, and the Enterprise tier is $1 per 1,000 assessments beyond that.

Google’s own migration guide is at docs.cloud.google.com/recaptcha/docs/migrate-recaptcha if you want the source material.

v3 or v2: pick before you create the key

The key type is fixed when you create it, and a plugin configured for v2 will not accept a v3 key (or the other way round), so decide first.

	reCAPTCHA v3 (score-based)	reCAPTCHA v2 checkbox	reCAPTCHA v2 invisible
What the visitor sees	Nothing, just a small badge	“I’m not a robot” checkbox, sometimes an image puzzle	Nothing unless suspicious, then a puzzle
How it decides	Returns a score from 0.0 (bot) to 1.0 (human); your site picks a threshold	Pass or fail	Pass or fail
Best for	Login, registration, comments, any form where friction hurts	Contact forms where you want a visible barrier	Forms where you want a barrier but no checkbox
Main risk	Threshold set too high blocks real people silently	Annoying for users; puzzles are an accessibility problem	Same as checkbox when triggered

Our default for WordPress is v3 with a threshold of 0.5, and v2 checkbox only where a client specifically wants a visible “protected” signal on a contact form. On BuddyPress and membership sites, where registration spam is the real problem, v3 catches the bulk of it without adding a puzzle to the signup flow.

Create a reCAPTCHA v3 key in Google Cloud

You need a Google account and a Google Cloud project. If you have never used Google Cloud, the project is free to create and you will not be charged unless you enable billing.

1. Go to console.cloud.google.com/security/recaptcha and sign in.
2. At the top of the page, use the project picker to select an existing project or click New project. Give it a name you will recognise later, for example “client-site-recaptcha”. One project can hold keys for many sites, so an agency can keep all client keys in one place or one per client, whichever matches how you bill.
3. If prompted, click Enable on the reCAPTCHA Enterprise API. Despite the name, this is the API for every tier including the free one.
4. Click Create key (or the + Create key button in the Keys tab).
5. Enter a Display name. Use the domain name so the list stays readable.
6. Under Platform type, choose Website.
7. Under Domain list, click Add a domain and enter your domain without “https://” or a trailing slash, for example example.com. Subdomains are covered automatically, so example.com also covers shop.example.com. Add your staging domain too if you want the same key to work there.
8. Expand the challenge options. For v3 behaviour, keep Score-based (no challenge) selected. For a v2 checkbox, choose Checkbox challenge instead.
9. Leave WAF integration off unless you are actually using Cloud Armor or a supported WAF.
10. Click Create key.

You will land on the key’s detail page showing the ID. That ID is your site key. Put it in the plugin field labelled “Site key”.

Finding the secret key

This is where most people get stuck. The Cloud console does not show a “secret key” on the main page the way the old console did. On the key detail page, open the Integration tab (or the three-dot menu next to the key in the list) and look for Use legacy key or Legacy secret key. Click it and copy the value. That is the secret key your WordPress plugin needs for server-side verification against the siteverify endpoint.

Treat the secret key like a password. It never goes in front-end code, only in the plugin settings or a server-side config.

Migrate an existing classic key

If your site has been using reCAPTCHA for a while, you probably have a classic key. Google’s recommended path is the migration tool in the old console:

1. Open google.com/recaptcha/admin. You should see a banner about migrating to Google Cloud.
2. Follow the banner, pick or create the destination Cloud project, tick the keys to move, and submit.
3. Wait a few minutes, then confirm the key shows under Security > reCAPTCHA > Keys in the Cloud console.

Or do it from the Cloud side: enable the reCAPTCHA Enterprise API, open the Keys tab, find your key under Classic keys, and click Upgrade key.

Two warnings. A key can only be migrated into one project and cannot be moved to a different project afterwards, so pick the right one (this matters if a client later wants ownership). And do not delete the classic key anywhere during or after migration.

Add the keys to WordPress

WordPress core has no CAPTCHA. You add it through a plugin, and most form plugins have a built-in integration. Wherever you put it, the process is the same: choose the version that matches your key, paste the site key and secret key, set a threshold for v3, and decide which forms are protected.

Form plugins

• Contact Form 7: Contact > Integration > reCAPTCHA > Setup Integration. CF7 only supports v3.
• WPForms: WPForms > Settings > CAPTCHA, choose reCAPTCHA, pick the type, paste keys, set the v3 score threshold. Then enable it per form under Settings > Spam Protection and Security.
• Gravity Forms: Forms > Settings > reCAPTCHA, then add a reCAPTCHA field or enable it in the form’s settings.
• Fluent Forms: Fluent Forms > Global Settings > Security > reCAPTCHA.

Login, registration, comments and community forms

Form plugins only protect their own forms. The WordPress login page, the registration page, comments, WooCommerce checkout and BuddyPress registration are separate. You can install one plugin per surface, but on client sites we prefer a single plugin that covers all of them with one set of keys. Wbcom CAPTCHA Manager does this for wp-login, registration, lost password, comments, WooCommerce and BuddyPress forms, and it lets you switch between reCAPTCHA v2, v3, hCaptcha and Cloudflare Turnstile without re-keying every form. If you run a community site, the BuddyX theme styles these CAPTCHA placements on registration without extra CSS.

Doing it by hand

If you are building a custom form, the server-side check is one POST request. Here is the minimum in WordPress:

$response = wp_remote_post(
    'https://www.google.com/recaptcha/api/siteverify',
    array(
        'body' => array(
            'secret'   => RECAPTCHA_SECRET_KEY, // define this in a config file, not in the template
            'response' => sanitize_text_field( wp_unslash( $_POST['g-recaptcha-response'] ?? '' ) ),
            'remoteip' => sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ),
        ),
    )
);

$result = json_decode( wp_remote_retrieve_body( $response ), true );

if ( empty( $result['success'] ) || ( isset( $result['score'] ) && $result['score'] < 0.5 ) ) {
    wp_die( esc_html__( 'Spam check failed. Please try again.', 'your-textdomain' ) );
}

Also check that $result['action'] matches the action name you passed when generating the token on the front end, and that $result['hostname'] is your domain. Skipping those checks lets an attacker reuse a token generated on another page.

Test before you walk away

Set up reCAPTCHA wrong and you block your own users without any error you can see. Run through this before closing the ticket:

1. Open the protected form in a private window and submit it normally. It should go through.
2. Check the v3 badge appears bottom-right of the page. If it does not, the site key is wrong, the domain is not in the allowed list, or a caching or optimisation plugin is deferring the reCAPTCHA script so it never loads.
3. Look for browser console errors such as "Invalid domain for site key" or "ERROR for site owner: Invalid key type". The second means you pasted a v2 key into a v3 slot or vice versa.
4. In the Cloud console open the key and look at the Metrics tab after an hour. You should see assessments being recorded with a score distribution. If it is empty, the secret key is not being verified server-side.
5. Log out and log back in. If login is protected and something breaks, you want to find out while you still have an open admin tab.

Common problems and fixes

Real users are getting blocked

Your v3 threshold is too high. Drop it from 0.7 to 0.5, or 0.3 on sites with a lot of VPN or privacy-browser traffic. Check the score distribution in Metrics; if most humans land at 0.3 to 0.5, a 0.7 threshold is rejecting them.

Spam is still getting through

Make sure the secret key is actually being verified. A site key alone does nothing; the plugin must call siteverify. Some older plugins silently skip verification when the request to Google fails, which means a firewall rule blocking outbound requests from your server turns reCAPTCHA off. Test with wp_remote_get( 'https://www.google.com/recaptcha/api/siteverify' ) from WP-CLI if you suspect this.

The badge covers a chat widget or button

Google allows hiding the badge as long as you show the required attribution text near the form. Add .grecaptcha-badge { visibility: hidden; } and include "This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply" with links below the submit button.

You are over the free quota

First reduce where reCAPTCHA fires. Protecting every page load instead of just form submissions burns assessments fast. If you are still over 10,000 a month, either enable billing ($8 per month covers most sites) or switch that surface to Cloudflare Turnstile, which is free with no quota and supported by most of the same WordPress plugins.

FAQ

Do I need a credit card to create a reCAPTCHA key now?

No. Creating a Google Cloud project and a reCAPTCHA key is free. You only add billing if you expect more than 10,000 assessments a month.

My old keys still work. Do I have to do anything?

If they still work, they were migrated (automatically or by you). Confirm they show up under Security > reCAPTCHA in a Cloud project you control, so you can manage domains and see metrics later.

Can one key cover several websites?

Yes, add each domain to the key's domain list. For client work we prefer one key per client so domains, metrics and ownership stay separate.

Does reCAPTCHA work on localhost?

Add localhost to the domain list and it will. For Local by Flywheel style domains such as mysite.local, add that domain too.

Is reCAPTCHA GDPR compliant?

It sends visitor data to Google, so you must mention it in your privacy policy and, in strict jurisdictions, load it only after consent. If that is a blocker for your audience, Turnstile or hCaptcha are the usual alternatives and both are supported by the plugins mentioned above.

Where to start

Create a Cloud project, make a score-based key with your production and staging domains, grab the legacy secret key from the key's Integration tab, and paste both into whichever plugin protects your forms. Set the v3 threshold at 0.5, test a real submission in a private window, then check the Metrics tab the next day. If you are adding protection to a community or membership site, cover login and registration as well as the contact form, because that is where the spam volume actually comes from.