# Spam protection (reCAPTCHA)

> Stop fake sign-ups, spam enquiries and bot orders with Google reCAPTCHA — your own keys, v3 or v2, strictness, and which forms to protect.

Product: NijeesWeb online store builder · Source: https://www.nijeesweb.com/docs/ecommerce/settings/spam-protection · Updated 2026-10-06

Every sign-in, sign-up, one-time code and password reset on your store is already **rate-limited**: too many tries from one connection in a minute are refused. **Google reCAPTCHA** adds a check that a real person — not a bot — is filling in the form.

![Spam protection](https://www.nijeesweb.com/marketing/img/docs/ecommerce/admin/settings-spam-1200.webp "Settings → Spam: check submissions against Google reCAPTCHA")

## Switch it on

1. Go to **Settings → Spam** and switch on **Check submissions against Google reCAPTCHA**.
2. If the screen says *Currently using the platform's shared keys*, protection already works — but your scores are pooled with every other store on the platform. For the best results, add **your own keys**:
   1. At [google.com/recaptcha/admin](https://www.google.com/recaptcha/admin), create a site and choose **reCAPTCHA v3**.
   2. Add **every domain your store answers on**, including the `www.` version — reCAPTCHA only works on the domains listed there.
   3. Copy the **Site Key** and **Secret Key** into Settings. The secret is stored encrypted and never shown again.
3. **Version** — **v3 (invisible, scored)** *(recommended)* or **v2 ("I'm not a robot" tick box)**.
4. **Strictness** (v3) — every visitor is scored from 0.0 (certainly a bot) to 1.0 (certainly a person); below your setting is rejected. **0.5** is Google's recommendation: raise it if spam gets through, lower it if real people are turned away.
5. Choose the forms to protect (below), and select **Save changes**.

*Not active yet* means a site key and a secret key are not both saved — yours or the platform's.

## Which forms

| Form | On by default |
| --- | --- |
| Website forms (page builder) | Yes |
| Customer registration | Yes |
| Password reset | Yes |
| One-time-code sign in | Yes |
| Guest order-access link | Yes |
| Checkout and enquiry | No |
| Sign in | No |

> [!WARNING]
> **Sign in** is off by default on purpose: if the keys are wrong, a captcha on the sign-in form locks you out of your admin panel. Switch it on only after you have checked that your contact form works with the new keys.

## More options

- **Notice shown under protected forms** — Google requires a notice where its badge is hidden (it is, here). Leave blank for the standard English wording.
- **If Google cannot be reached: Reject submissions rather than let them through** — off by default, so a Google outage never blocks your own sign-in or your enquiries.

## If you get locked out

If sign-in fails because of reCAPTCHA, use **Use a one-time code** — or [contact support](https://www.nijeesweb.com/contact?topic=support) and we will switch the check off for you. See [Admin sign-in problems](https://www.nijeesweb.com/docs/ecommerce/troubleshooting/admin-sign-in).