How to Add reCAPTCHA to a WordPress Form

Google reCAPTCHA is the most widely recognized spam-blocking widget on the web, and adding it to a WordPress form with Contactum is a two-part process: get your keys from Google, then connect them in Contactum. Here’s the full walkthrough.

Step 1: Get Your Site Key and Secret Key

Go to google.com/recaptcha and register your site. Google will give you two values: a Site Key (public, used on the frontend to render the widget) and a Secret Key (private, used server-side to verify a submission). Copy both — you’ll need them in the next step.

Step 2: Save the Keys in Contactum

In your WordPress dashboard, go to Contactum → Settings → reCAPTCHA, paste in the Site Key and Secret Key, and save. This step makes reCAPTCHA available to your forms — it doesn’t add it to any form automatically.

Step 3: Add the reCAPTCHA Field to Your Form

Open the form you want to protect in the builder, and drag the reCAPTCHA field (found alongside the other CAPTCHA field types) onto the canvas — typically placed just above the Submit button. Save the form.

The Most Common Mistake

The reCAPTCHA widget only renders on the frontend once both conditions are true: the keys are saved under Settings, and the reCAPTCHA field has actually been added to that specific form. Saving the keys alone doesn’t retroactively protect every existing form — you have to add the field to each form individually. If a CAPTCHA “isn’t showing up,” this is the first thing to check, followed by confirming the keys were copied without extra whitespace.

Step 4: Test It

Visit the live page in a private/incognito browser window (so you’re not logged into WordPress) and confirm the reCAPTCHA widget appears and the form submits normally after completing it. Then try submitting without interacting with the widget at all — the submission should be blocked.

reCAPTCHA vs. the Alternatives

reCAPTCHA is the most recognizable option to visitors, but it isn’t the only one Contactum supports. hCaptcha follows the identical Site Key/Secret Key setup pattern and is positioned as more privacy-focused. Cloudflare Turnstile uses the same pattern too and is often the least intrusive of the three, since it can pass silently for most visitors without ever presenting a visible challenge. All three plug into Contactum the same way — get keys, save under Settings, add the matching field to a form — so switching providers later is a quick change, not a rebuild.

Remember, too, that reCAPTCHA is an additional layer — every Contactum form already has an invisible honeypot field, a minimum-time-to-submit check, and per-IP rate limiting running by default, so even a form without a visible CAPTCHA isn’t defenseless.