How to Generate a Google reCAPTCHA (Site Key & Secret Key): A Step-by-Step Guide

This blog is a simple, step-by-step guide to generating your Google reCAPTCHA Site Key and Secret Key, choosing the right version for your site, and adding it to your forms, whether you’re on WordPress or a custom-built website. 

If your website has ever been hit with a flood of spam form submissions, fake sign-ups, or bot-driven login attempts, you already know why so many site owners search for “how to generate a Google reCAPTCHA.” It’s one of the fastest, most reliable ways to keep automated bots out of your forms without adding real friction for genuine visitors.

The process itself is simple once you know where to look. Google doesn’t charge for the standard version, and you don’t need to write complex code to get started. This guide walks through exactly how to generate your reCAPTCHA keys, which version to choose, and how to add them to your website.

What Is Google reCAPTCHA, Exactly?

Google reCAPTCHA is a free security service that protects websites from spam and abuse. It works by analyzing visitor behavior and interactions in the background and, in older versions, by asking users to complete a simple challenge to determine whether a visitor is a human or a bot.

To use it, you need a key pair:

• Site Key: a public key embedded in your website’s front-end code. It tells Google which site is requesting verification and is visible in your page source.
• Secret Key: a private key that stays on your server. It’s used to verify the visitor’s response with Google’s servers and should never be exposed in public-facing code.

These two keys work together: the Site Key displays the reCAPTCHA widget (or runs the invisible check) on your page, while the Secret Key validates that response server-side before you trust the form submission.

Which reCAPTCHA Version Should You Choose?

Before generating your keys, you’ll need to pick a version. Google currently offers a few options, and the right one depends on how much friction you’re willing to add for real users.

reCAPTCHA v2: Checkbox: This is the classic “I’m not a robot” checkbox. Visitors click it, and depending on their behavior, may be asked to complete an image recognition challenge. It’s visible, familiar to users, and easy to implement.

reCAPTCHA v2: Invisible: Instead of a checkbox, this runs in the background and only shows a challenge if the visitor’s behavior looks suspicious. Most users never see anything at all.

reCAPTCHA v3: This version removes challenges entirely. It scores each visitor’s behavior silently in the background on a scale, and you decide what score threshold counts as “likely human” versus “likely bot.” A small badge appears in the corner of the page, but there’s no checkbox or puzzle to solve. This is the best option for checkout pages, sign-up forms, or anywhere a challenge would hurt conversions.

reCAPTCHA Enterprise: Built for larger businesses that need advanced fraud analytics, account defender features, and deeper Google Cloud integration. It requires a Google Cloud billing account and is typically overkill for standard websites and blogs.

For most WordPress sites, blogs, and small business websites, v2 Invisible or v3 offer the best balance of security and user experience.

Step-by-Step: How to Generate Your reCAPTCHA Site Key and Secret Key

Step 1: Sign in to Your Google Account

You’ll need a Google account to access the reCAPTCHA admin console. If you’re managing this for a client or team, it’s worth using a shared or business Google account rather than a personal one, so access isn’t tied to a single person.

Step 2: Go to the reCAPTCHA Admin Console

Visit Google’s reCAPTCHA admin console and sign in. If you’re setting up reCAPTCHA v3 through Google Cloud, you’ll instead land on the Google Cloud Fraud Defense console, which now handles key creation for newer integrations. Both paths are officially supported; the classic console remains the simplest route for most standard websites.

Step 3: Register a New Site

Click the “+” button to register a new site. You’ll be asked to fill in a few details:

• Label: A name to help you identify this key later (especially useful if you manage multiple sites). Using your domain name as the label keeps things organized.
• reCAPTCHA type: Choose v2 (Checkbox or Invisible) or v3 (Score-based), based on the version you selected above.
• Domains: Enter the domain(s) where this key will be used. You can register multiple domains under a single key, which is useful if you run a staging environment alongside your live site. Google allows up to 250 domains per key.
• Owners: Add any other Google accounts (like teammates or developers) who should have access to manage this key.

Step 4: Accept the Terms of Service

Review and accept the reCAPTCHA Terms of Service checkbox. You can also opt in or out of sharing usage data with Google’s reCAPTCHA network; this doesn’t affect functionality either way.

Step 5: Submit and Copy Your Keys

Click Submit. Google will immediately generate your Site Key and Secret Key on the next screen. This is the only time both keys are displayed together this clearly, so copy them somewhere secure right away, such as a password manager or your site’s environment configuration file. Never paste the Secret Key into front-end code, public repositories, or anywhere visitors could view your page source.

That’s it, your keys are now active and ready to use.

How to Add reCAPTCHA to Your Website

Once you have your keys, how you implement them depends on your setup.

If You’re Using WordPress

You don’t need to touch any code. Most contact form plugins (WPForms, Contact Form 7, Gravity Forms) and security plugins have a dedicated reCAPTCHA settings field. Simply:

1. Go to the plugin’s settings page.
2. Paste in your Site Key and Secret Key.
3. Select the matching reCAPTCHA version you registered.
4. Save changes and test the form.

If You’re Building a Custom Website

For v2 Checkbox, add this snippet where you want the widget to appear:

html

<scriptsrc=“https://www.google.com/recaptcha/api.js”asyncdefer></script>

<divclass=“g-recaptcha”data-sitekey=“YOUR_SITE_KEY”></div>

For v3, reCAPTCHA runs invisibly and generates a token you send along with your form submission:

html

<scriptsrc=“https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY”></script>

On the server side, that token is then sent to Google’s verification endpoint along with your Secret Key to confirm the score before you process the form submission. This server-side check is what actually stops bots; the front-end script alone doesn’t block anything on its own.

Common Mistakes to Avoid

Mismatched domains. If your Site Key is registered for example.com but your form loads on www.example.com, reCAPTCHA won’t work. Register both variants, or use a wildcard where supported.

Exposing the Secret Key. This key must only ever live in server-side code or environment variables, never in JavaScript, HTML, or public repositories.

Choosing the wrong version for the job. A visible checkbox on a high-conversion checkout page can quietly hurt completion rates. If friction matters, v3’s invisible scoring is usually the better fit.

Forgetting to test after switching versions. If you migrate from v2 to v3, old integration code won’t work with new keys; the implementation snippet is different for each version.

Ignoring the score threshold in v3. Unlike v2, v3 doesn’t block anyone outright — it returns a score, and it’s up to you to decide the cutoff. Setting it too strict can block real users; too lenient, and bots get through.

Frequently Asked Questions

Is Google reCAPTCHA free? 

Yes. The standard reCAPTCHA v2 and v3 keys are free for typical usage and don’t require a Google Cloud billing account. Only reCAPTCHA Enterprise, aimed at large-scale fraud protection, requires billing setup.

Can I use the same reCAPTCHA key on multiple websites? 

Yes, as long as each domain is added to the key’s domain list during setup or afterward through the admin console.

What’s the difference between the Site Key and Secret Key? 

The Site Key is public and renders the widget on your page. The Secret Key is private and is used only for server-side verification of the visitor’s response.

Do I need to know how to code to set this up? 

No, if you’re using WordPress or a form-builder plugin, you can typically paste your keys directly into a settings field. Custom-built websites will need a developer to add the script and handle server-side verification.

Will reCAPTCHA slow down my website? 

The impact is generally minimal. reCAPTCHA v3 in particular runs quietly in the background without interrupting the user experience, though as with any third-party script, it’s good practice to load it asynchronously.

Final Thoughts

Generating a Google reCAPTCHA key takes only a few minutes, but the impact on your website’s security can be significant: fewer spam submissions, cleaner analytics, and stronger protection for your login and checkout forms. The key decision isn’t the setup process itself, which is straightforward, but choosing the version that matches how much friction you’re willing to introduce for real visitors. For most sites, starting with v3 or invisible v2 offers strong protection without getting in anyone’s way.