Spam protection with Google reCAPTCHA

Public forms attract spam bots. Google reCAPTCHA checks each submission and rejects the bots, usually without real visitors noticing anything.

Shared keys or your own#

Out of the box your site may use the platform's shared keys — the settings screen tells you when it does. That works, but your scores and your spam history are pooled with every other site on the platform. For the best protection, add your own (free) keys.

Get your own keys#

1. Go to google.com/recaptcha/admin and sign in.
2. Create a site: choose reCAPTCHA v3 (score-based, invisible).
3. Under Domains, add every domain this website answers on, including the www. version — for example sharmadental.in and www.sharmadental.in. reCAPTCHA only works on the domains listed there.
4. Google gives you a Site Key and a Secret Key.

Add them to your website#

1. Open Settings › General Settings › Spam protection (Google reCAPTCHA).
2. Switch on Check submissions against Google reCAPTCHA.
3. Paste the Site Key — public; it appears in your pages' source, which is normal.
4. Choose the Version — v3 (invisible, scored) or v2 ("I'm not a robot" tick box) — matching the keys you created.
5. Paste the Secret Key — private; never shown again once saved. Later, leave it blank to keep it.
6. Save.

Protection stays off until both a site key and a secret key are saved.

Strictness (v3)#

reCAPTCHA v3 scores every visitor from 0.0 (certainly a bot) to 1.0 (certainly a person); anything below this is rejected. 0.5 is Google's recommendation. Raise it if spam still gets through, lower it if real people are being turned away.

Which forms are protected#

Under Protect these forms, tick the forms to check — your website's forms are the main one.

Notice under forms#

Google requires a short notice wherever its badge is hidden (it is hidden on NijeesWeb sites so it doesn't collide with your floating buttons). Notice shown under protected forms lets you change or translate that sentence; links to Google's Privacy Policy and Terms are always added.

If Google cannot be reached#

Reject submissions rather than let them through is off by default: an outage at Google would otherwise block your own sign-in and every enquiry. Submissions still pass the rate limit and every other check. Switch it on only if you face a heavy, targeted spam attack.

Problems? See Forms and spam checks.