Custom reCAPTCHA

Where do I turn it on?

Open your form, click Settings and scroll to Spam & Security. Turn on Custom reCAPTCHA and add your own Google reCAPTCHA keys. Custom reCAPTCHA is available on all plans, including Free.

When should I use Custom reCAPTCHA?

The dashboard marks Custom reCAPTCHA as recommended, and it's the option I'd pick for any form that gets real traffic. It works with plain HTML posts, with fetch() or Ajax, and with file uploads.

If your form only posts as ordinary HTML, with no files and no Ajax, Automatic reCAPTCHA can be enough. Use this page when you want the widget on your form, or when Automatic reCAPTCHA would drop files or break your script.

How do I set it up?

1. Go to the Google reCAPTCHA Admin Console at https://www.google.com/recaptcha/admin.
2. Register your site. Choose reCAPTCHA v2, the "I'm not a robot" checkbox, and add your domain. Add localhost too if you test locally.
3. Copy the Site Key and the Secret Key.
4. In Formbold, open Settings > Spam & Security and turn on Custom reCAPTCHA.
5. Paste the Site Key and Secret Key into their fields and save.
6. Add the reCAPTCHA script and widget to your form, as below.

The Learn How link next to the toggle brings you back to these steps.

<!-- 1. Load the Google reCAPTCHA script -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

<form action="https://formbold.com/s/YOUR_FORM_ID" method="POST">
  <label for="email">Email:</label>
  <input type="email" name="email" id="email" required />

  <label for="message">Message:</label>
  <textarea name="message" id="message" required></textarea>

  <!-- 2. Put the widget just before the submit button -->
  <div class="g-recaptcha" data-sitekey="YOUR_RECAPTCHA_SITE_KEY"></div>

  <button type="submit">Submit</button>
</form>

The Site Key goes in your HTML. The Secret Key goes only into Formbold. Never put the Secret Key in your page.

Why are real submissions failing after I added reCAPTCHA?

Usually the domain isn't registered in the Google console. Add every domain that serves the form, including www and staging. The other common cause is pasting the keys the wrong way round, so check that the Site Key and Secret Key are in the right fields.