Google reCAPTCHA integration process

Google have recently updated the reCAPTCHA setup and process for integration. Their reCAPTCHA technology is an anti-spam measure for website forms, that in its latest iteration runs in the background so there is no need for users to click images to verify. Here is a brief overview of how we've added reCAPTCHA to our client's sites.

Get your API keys

Register via https://console.cloud.google.com/  and enable the reCAPTCHA API service. This will allow you to generate API keys that can be added to your website. The latest process requires both a Google API key and a reCAPTCHA API key.

To create a normal API key go to Google Console API Credentials page:

https://console.cloud.google.com/apis/credentials/key/ 

To avoid misuse, we recommend setting "Application restrictions" to your own Website/s or IP Addresses, and also applying "API Restrictions so it can only be used by the reCAPTCHA Enterprise API.

To get your reCAPTCHA key, go to the reCAPTCHA area:

https://console.cloud.google.com/security/recaptcha 

Again, we recommend restricting the key by domain to ensure only your website/s can use it.

Applying to your website

We have a JavaScript file that creates the link to load up the Google Javascript code and initialises the reCAPTCHA JavaScript API, this is where the reCAPTCHA API key is added. This file is called recaptcha.js.

We have another JavaScript file called forms.js that contains the reCAPTCHA API key, which is triggered when a form is used e.g. a contact form submission / job submission / quote form etc. The reCAPTCHA JavaScript API in the client requests a verdict from reCAPTCHA based on the users behaviour on the site. reCAPTCHA returns an encrypted reCAPTCHA token to us, that we then submit to be processed along with any other functionality or data.

We then add code to whatever function processes the users website request (e.g. form submission). This is where we use the normal Google API key and also the reCAPTCHA key again. We take the token submitted along with these keys and send that information to Google reCAPTCHA to create an assessment to analyse the risk of this user interaction. reCAPTCHA returns a verdict to our backend code based on the risk evaluated for this request. This verdict consists of scores from 0.0 through 1.0 and reason codes.

We usually set the score threshold to 0.5 and any score lower than that we reject by stopping the code from processing the user interaction further. A score greater than or equal to 0.5 is allowed to proceed.

Find out more here:

https://cloud.google.com/recaptcha/docs/overview?authuser=2 

Or get in touch if you need help.