How To Set Up Google reCAPTCHA

reCAPTCHA is Google’s service for telling people and spam bots apart. Tirenoa can use it in forms built with Tirenoa Forms, in the comment form and in the login, registration and lost password elements. To switch it on you need two keys from Google, a site key and a secret key.

reCAPTCHA connects your visitors’ browsers to Google and sends Google data about them. In many countries this must be mentioned in the privacy policy, and it may require consent. If you prefer an alternative, the same options section offers Cloudflare Turnstile, described at the end of this guide.

In this article: Get the Keys From Google · Enter the Keys in Tirenoa · Add reCAPTCHA to a Form · Comments and Login Forms · If Submissions Are Rejected · Cloudflare Turnstile Instead · Related

1. Sign in with a Google account at the Google reCAPTCHA admin console and register a new site.
2. Choose the reCAPTCHA type. Tirenoa supports two: v3 (score based, no task for the visitor) and the v2 checkbox (“I’m not a robot”).
3. Enter the domain of your website exactly as visitors use it.
4. Finish the registration. Google shows a site key and a secret key. Keep the page open or copy both.

Note: Keys belong to one type. A v2 key does not work with the v3 setting and the other way round. If you change the version later, register a new pair of keys.

1. Go to Tirenoa › Options › Forms › Google reCaptcha.
2. Set reCAPTCHA Version to the type you registered: V2 or V3.
3. Paste the keys into reCAPTCHA Site Key and reCAPTCHA Secret Key.
4. Save the options.

Depending on the version, more options appear:

1. Go to Tirenoa › Forms and edit the form.
2. Add the reCAPTCHA Field element, usually just above the submit button. One per form is enough.
3. Save the form and send a test submission while you are logged out.

The element can override reCAPTCHA Color Scheme and reCAPTCHA Badge Position for this one form. With V3, visitors see only the badge. With V2, they have to tick the checkbox before sending.

Note: Save the keys first, then add the field. A form that contains a reCAPTCHA field while the keys are missing rejects every submission. Visitors see nothing in its place; only administrators see a configuration error where the field should be.

Two switches in the same options section extend the protection beyond Tirenoa Forms:

• reCAPTCHA For User Elements adds it to the User Login, User Lost Password and User Register elements.
• reCAPTCHA For Comments adds it to the comment form for visitors who are not logged in.

The message for visitors is that reCAPTCHA could not verify that they are human. Common causes:

• The version in the options does not match the type of the keys.
• The site key and secret key are swapped or incomplete.
• The domain registered at Google is not the address of the site. With V3 the answer from Google must name the same domain as your site address, so a site reachable under a second domain fails there.
• With V3, the reCAPTCHA Security Score is set too high. Go back towards 0.5.
• The visitor’s browser blocks Google scripts, for example through an add-on. Without an answer from reCAPTCHA the form cannot be sent.

Turnstile is a comparable check from Cloudflare. It connects your visitors’ browsers to Cloudflare instead of Google. Use one of the two services in a form, not both.

1. Create a Turnstile widget for your domain in your Cloudflare account and copy the site key and secret key.
2. Go to Tirenoa › Options › Forms › Cloudflare Turnstile and paste them into Site Key and Secret Key.
3. Optionally set the appearance mode (Always or Interaction Only), Color Scheme, Widget Size and Language, and switch on Turnstile For Comments.
4. Save the options, then add the Turnstile Field element to your form.

Note: The same rule applies: a Turnstile field without saved keys blocks the form. A submission is also rejected when Cloudflare cannot be reached at that moment.

• reCAPTCHA Field Element – the field you add to a form
• Turnstile Field Element – the Cloudflare alternative
• Honeypot Field Element – simple spam protection without an outside service
• How To Use Tirenoa Forms – building the form itself