---
url: /integrations/recaptcha.md
---
# reCAPTCHA

Google reCAPTCHA protects form submissions and event registrations. Evolve verifies the token on the server and, for v3 keys, enforces a minimum score. The honeypot runs alongside it, so a site without keys is not unprotected. The full behaviour, key types, theme integration and troubleshooting are on [Form Spam Protection](/panel/form-spam-protection); this page is the checklist for the account side.

## What you need

A reCAPTCHA key pair from the [reCAPTCHA admin console](https://www.google.com/recaptcha/admin), created as **v3** (recommended) or **v2 Invisible**. A v2 Checkbox key does not work with the theme. Register the live domain and, if the check should run there too, the staging domain on the key. Keys bound to the wrong domain fail every submission.

## Keys

| Variable | Default | Panel | Effect |
|---|---|---|---|
| `GOOGLE_RECAPTCHA_SITEKEY` | unset | Settings > Tracking > Google | Switches the theme to the reCAPTCHA submit button and loads `api.js`. |
| `GOOGLE_RECAPTCHA_SECRET` | unset | yes, masked | Switches the server check on. |
| `GOOGLE_RECAPTCHA_SCORE` | `0.5` | yes | Minimum v3 score (since 2.16). |

Set site key and secret together. If Google cannot be reached, the submission is rejected rather than let through.

## Privacy

reCAPTCHA sends visitor data to Google and sets cookies. The site's privacy policy has to mention it; that is the site owner's responsibility.

## Verifying

Submit a form: it goes through without a visible challenge. The reCAPTCHA admin console shows requests for the key within minutes. A rejected real submission means the score is too strict; lower `GOOGLE_RECAPTCHA_SCORE` in steps of 0.1.