reCAPTCHA is Google's free SPAM protection for forms. To use it on an EverWeb contact form, you create two keys with your Google account, a site key and a secret key, and paste them into the form's settings. It takes about 10 minutes.
Since 2025, every reCAPTCHA key belongs to a Google Cloud project. You don't need to know anything about Google Cloud: Google creates or picks the project for you, and the free plan covers up to 10,000 checks a month, which is far more than most websites' forms receive.
Create your keys
- Go to Google's reCAPTCHA page at https://www.google.com/recaptcha/admin/create and sign in with your Google account.
- In Label, type a name you'll recognise, such as your website's name.
- Choose the type:
- For EverWeb 4.5, or reCaptcha v2 in EverWeb 4.6: choose Challenge (v2), then "I'm not a robot" Checkbox.
- For reCaptcha v3 in EverWeb 4.6 and later: choose Score based (v3).
- Under Domains, add your website's domain, such as yourdomain.com, without www or https://. Add every other address you publish the same website to, such as a test copy.
- If Google asks for a Google Cloud project, keep the one it suggests or create a new one.
- Accept the terms if asked, and click Submit.
- Google shows your site key and secret key. Copy both. You can see them again later in the same reCAPTCHA page, under your site's settings.
Add the keys to your contact form
- In EverWeb, select your Contact Form Advanced widget and open Inspector > Widget Settings.
- Scroll to SPAM Protection and tick Use reCaptcha SPAM Protection. In EverWeb 4.6 and later, also choose the matching Captcha Provider.
- Paste the site key into reCaptcha Site Key and the secret key into reCaptcha Secret Key. Don't swap them, and don't add spaces.
- Publish your website, then send yourself a test from a private browser window.
The reCAPTCHA box only appears on your published website, not in Preview.
If you made the key in the Google Cloud console instead
Keys can also be made in the Google Cloud console, on its reCAPTCHA page (Google now calls it Fraud Defense). There the secret key EverWeb needs is called the legacy key:
- On the reCAPTCHA page, open the Keys tab and click your key.
- Open the Integration tab and click Use legacy key.
- Copy that key into reCaptcha Secret Key in EverWeb.
A key made in the Google Cloud console is score-based (v3) unless you turn on Will you use challenges? when you create it. For EverWeb 4.5, which uses the "I'm not a robot" checkbox, creating the key at the reCAPTCHA page above is simpler.
Good to know
- Keys only work with the type they were made for. A v2 key doesn't work with v3. If you change type, create new keys.
- Over 10,000 checks a month: Google asks you to add billing to the project. Until you do, it stops checking, so your form works but isn't protected.
- Google says your key needs migrating: older keys made before 2025 are being moved into Google Cloud projects. Follow Google's prompt in the reCAPTCHA page. Your keys stay the same, so you don't need to change anything in EverWeb.