Question : How to create your CAPTCHA with Google and add it to your forms

To add Google reCAPTCHA to a form, register your site in the Google reCAPTCHA admin console, copy the Site Key and Secret Key it gives you, and paste both into your form's security settings. In Mailpro this takes under 5 minutes, and it stops bots and spammers from polluting your subscription forms.

Why do forms need a CAPTCHA?

A CAPTCHA is a test that is easy for people and hard for bots. Without one, a public signup or contact form attracts automated submissions: fake addresses, spam messages and sometimes real people's emails entered without their consent. Those fake contacts bounce, trigger spam complaints and hurt the reputation of every campaign you send afterwards.

Which reCAPTCHA version should I choose?

The keys are tied to a version: keys created for v2 do not work with v3, and the other way round. If you switch versions, create a new pair.

Step 1 — Get your reCAPTCHA keys

1. Go to the Google reCAPTCHA admin console and sign in with a Google account.
2. Click + to register a new site.
3. Pick reCAPTCHA v2 "I'm not a robot" or v3 (invisible).
4. Add your domain (e.g. example.com). Add every domain where the form will appear.
5. Accept the terms and click Submit.
6. Copy the Site Key and Secret Key.

The Site Key is public (it sits in the page code). The Secret Key must stay private: never paste it into a web page or share it by email.

Step 2 — Paste them into your Mailpro form

1. Sign in to Mailpro and open the Forms module.
2. Edit your subscription form.
3. In Security → Captcha, paste the Site Key and Secret Key.
4. Save and re-publish the form.

If the form is embedded on your website, the published version updates automatically. To place it on a page, see how to embed a form on your website.

Step 3 — Verify it works

• Open your form on the live page in an incognito window.
• Submit a test entry — the captcha should run successfully.
• Check the statistics dashboard for blocked attempts.

Why is my reCAPTCHA not working?

• “Invalid domain for site key”: the domain where the form is displayed is missing from the list in the reCAPTCHA console. Add it and wait a few minutes.
• Keys swapped: the Site Key and Secret Key were pasted in each other's fields.
• Wrong version: v2 keys used in a v3 setting, or the reverse.
• Ad or script blockers: some browser extensions block Google scripts. Test in a clean incognito window.

Best practices

• Combine reCAPTCHA with double opt-in for extra safety: even a human who types someone else's address cannot subscribe them.
• Add an honeypot field for older bots that don't even reach reCAPTCHA.
• Rotate the secret key once a year, or after any leak.
• Always show a privacy note linking to Google's privacy policy (GDPR).
• Keep accessibility in mind: image challenges can be hard for some users, and v3 avoids them.

For other ways to keep bots out, read how to protect a form from spam and bots.

Frequently asked questions

Is Google reCAPTCHA free?

Google offers reCAPTCHA free of charge up to a monthly usage limit, which is far above the traffic of a typical signup form.

Does a CAPTCHA reduce signups?

A visible challenge adds a small step, so some friction is possible. The invisible v3 version avoids it, and the fake contacts you no longer collect usually matter more than a handful of lost clicks.

Is reCAPTCHA GDPR-compliant?

It sends visitor data to Google, so mention it in your privacy notice and link to Google's privacy policy. Your form data itself stays in Mailpro, which is GDPR-compliant and hosted in Switzerland.

Mailpro forms include reCAPTCHA, double opt-in, customizable design and direct sync to your contact list. Discover Mailpro Forms · Sign-up form feature

Related reading:

• Form with CAPTCHA: feature overview
• Double opt-in subscription
• Customize form design
• Email confirmation form
• Password-protected forms