reCAPTCHA v3 (Invisible) and the Minimum Score

reCAPTCHA v3 checks visitors without asking them to do anything. Google watches how the visitor uses the page and returns a score from 0.0 (very likely a bot) to 1.0 (very likely a person). The portal refuses any form sent with a score below your Min Score (v3). Choose it when you want no checkbox or puzzle on your forms.

Get your reCAPTCHA v3 keys#

1. Open the Google reCAPTCHA admin console (www.google.com/recaptcha/admin) and sign in.
2. Create a new site (key) and choose reCAPTCHA v3 (score based) as the type.
3. Add your store’s domain (for example example.com), plus any staging domain.
4. Choose or create the Google Cloud project the key belongs to, then submit.
5. Copy the site key and the secret key.

The tab’s Google Cloud note applies here too: every reCAPTCHA key now lives in a Google Cloud project, the first 10,000 checks a month are free, and above that, without billing set up in Google Cloud, Google lets every check pass, so forms are no longer protected.

Set it up in the portal#

1. Go to WooCommerce > Account Portal > CAPTCHA / Spam.
2. Under Provider, choose reCAPTCHA v3 (invisible / score).
3. Paste the keys into Site Key and Secret Key.
4. Set Min Score (v3) (start with the default, 0.5).
5. Under Apply to, tick the forms to protect.
6. Click Save Settings.
7. Log out and test each protected form at /my-account/ and in the account drawer.

Min Score (v3)#

Item	Value
Label	Min Score (v3)
Range	0.0 to 1.0, in steps of 0.1 (values outside are saved as 0.0 or 1.0)
Default	0.5 (Google’s recommendation)
Description on the tab	0.0 = allow all, 1.0 = block all. Google recommends 0.5.

A form passes when Google’s score is equal to or higher than this value.

• Lower it (for example 0.3) if real customers report “CAPTCHA verification failed”. People on VPNs, privacy browsers or new devices can get lower scores.
• Raise it (for example 0.7) if fake accounts or login attempts still get through.

Action names#

Each form asks Google for a token with its own action name. Google returns the action with the score, and the portal checks that it matches the form, so a token made for one form cannot be used on another.

Form	Action name
My Account login	wap_login
My Account registration	wap_register
My Account lost password	wap_lost_password
Account drawer login	wap_nav_login
Account drawer password reset	wap_nav_forgot

These are the names you see in the reCAPTCHA admin console. They are fixed in the plugin; there is no setting or filter to change them.

What customers see#

There is no widget on the form. The portal asks Google for a token at the moment the customer sends the form, then sends it. Google shows its reCAPTCHA badge on pages where the script loads (the My Account pages for logged-out visitors, and other pages when the account drawer is in use).

How the check works#

1. The customer clicks the form’s button.
2. The portal asks Google for a token for that form’s action and adds it to the form.
3. Your server sends the token to Google with your secret key and the visitor’s IP address.
4. The form is refused with CAPTCHA verification failed. Please try again. when Google says the token is not valid, the score is below Min Score (v3), or the action does not match the form.

If the visitor’s browser cannot reach Google, the form is sent without a token and is refused. If your server cannot reach Google, the request is let through by default (see “If the provider is down” in Setting Up CAPTCHA: An Overview and the wap_captcha_fail_open filter).

Troubleshooting#

Problem	Likely cause
Every attempt fails	The Secret Key is missing or wrong, the keys are v2 keys, or Min Score (v3) is set to 1.0.
Some real customers fail	Their score is below your minimum. Lower Min Score (v3) a step at a time.
Bots still get through	Raise Min Score (v3), check the Google Cloud billing limit, or switch to a provider with a visible check.
No check at checkout or on wp-login.php	Expected. The portal’s CAPTCHA only protects the My Account forms and the account drawer.

Related#

• Setting Up CAPTCHA: An Overview
• reCAPTCHA v2 (Checkbox)
• Cloudflare Turnstile: Visible or Invisible
• hCaptcha