EFE Visual Forms reCAPTCHA and Spam Protection Setup

EFE Visual Forms has three layers of spam protection. Two work automatically on every form; the third, Google reCAPTCHA, is optional and uses your own Google keys. This guide explains each layer and how to set up reCAPTCHA.

Built-in protection (no setup)

Choose a reCAPTCHA type

The keys must match the type: v2 keys do not work with v3 and the other way around.

Step 1: Create the keys at Google

1. Open the reCAPTCHA admin console and create a new site.
2. Choose reCAPTCHA v2 (“I’m not a robot” or “Invisible”) or reCAPTCHA v3, matching the type you will pick in the builder.
3. Add your domain (for example example.com). Add your staging domain too if you test there.
4. Copy the Site Key and the Secret Key.

Step 2: Add the CAPTCHA field to the form

1. Open the form in the builder.
2. In Add Fields > Advanced Fields, drag CAPTCHA onto the form, usually just above the Submit button.
3. In Field Settings, choose the reCAPTCHA Type, paste the Site Key and the Secret Key.
4. Click Save Changes.

The keys are saved with this form. Add the field to every form that needs reCAPTCHA.

Step 3: Test it

Open the page with the form while logged out (or in a private window), fill it in and send it. Then check EFE Visual Forms > Entries. With v2 you should see the checkbox; with invisible v2 and v3 you should see the reCAPTCHA badge.

What is sent to Google

reCAPTCHA is a Google service and is used only on forms where you add the field with your keys:

• On pages with such a form, the visitor’s browser loads https://www.google.com/recaptcha/api.js. Google receives the visitor’s IP address, browser data and the page URL.
• When the form is sent, your server sends the reCAPTCHA token, your secret key and the visitor’s IP address to https://www.google.com/recaptcha/api/siteverify.

Mention reCAPTCHA in your privacy policy. Google’s terms: https://policies.google.com/terms and privacy policy: https://policies.google.com/privacy.

For developers

Change the minimum v3 score (default 0.5):

add_filter( 'wpvfb_recaptcha_min_score', function ( $min, $field ) {
    return 0.7;
}, 10, 2 );

Change the rate limit (default 10 submissions per minute per IP and form; 0 turns it off):

add_filter( 'wpvfb_submission_rate_limit', function ( $limit, $form_id ) {
    return 20;
}, 10, 2 );

Troubleshooting

“Please complete the CAPTCHA verification.”

The token was missing or Google did not accept it. Check that the Site Key and Secret Key belong to the same Google site, that the type matches the keys, and that your domain is listed in the reCAPTCHA console. With v3, the visitor’s score may also be below the minimum.

“CAPTCHA verification is temporarily unavailable. Please try again.”

Your server could not reach Google. Ask your host whether outgoing HTTPS requests to www.google.com are blocked by a firewall.

The field shows a simple checkbox instead of Google reCAPTCHA

No Secret Key is saved on the field. Without keys the field is only a required checkbox and does not stop bots. Add both keys.

“Too many submissions. Please wait a minute and try again.”

The visitor hit the rate limit of 10 submissions per minute. This is rare for real visitors; raise the limit with the filter above if several people share one IP address (for example an office network).

Related Resources & Official Links