reCAPTCHA
Google reCAPTCHA protects form submissions and event registrations. Evolve verifies the token on the server and, for v3 keys, enforces a minimum score. The honeypot runs alongside it, so a site without keys is not unprotected. The full behaviour, key types, theme integration and troubleshooting are on Form Spam Protection; this page is the checklist for the account side.
What you need
A reCAPTCHA key pair from the reCAPTCHA admin console, created as v3 (recommended) or v2 Invisible. A v2 Checkbox key does not work with the theme. Register the live domain and, if the check should run there too, the staging domain on the key. Keys bound to the wrong domain fail every submission.
Keys
| Variable | Default | Panel | Effect |
|---|---|---|---|
GOOGLE_RECAPTCHA_SITEKEY | unset | Settings > Tracking > Google | Switches the theme to the reCAPTCHA submit button and loads api.js. |
GOOGLE_RECAPTCHA_SECRET | unset | yes, masked | Switches the server check on. |
GOOGLE_RECAPTCHA_SCORE | 0.5 | yes | Minimum v3 score (since 2.16). |
Set site key and secret together. If Google cannot be reached, the submission is rejected rather than let through.
Privacy
reCAPTCHA sends visitor data to Google and sets cookies. The site's privacy policy has to mention it; that is the site owner's responsibility.
Verifying
Submit a form: it goes through without a visible challenge. The reCAPTCHA admin console shows requests for the key within minutes. A rejected real submission means the score is too strict; lower GOOGLE_RECAPTCHA_SCORE in steps of 0.1.