Enabling reCAPTCHA for Forms

Forge forms support Google reCAPTCHA v3. It runs in the background when someone submits. There is no checkbox, no widget to place in your HTML, and you do not add Google’s script yourself.

Step 1: Create a reCAPTCHA v3 key

1. Open the Google reCAPTCHA Admin Console
2. Register a new site
3. Choose reCAPTCHA v3 — not v2, not “I’m not a robot” Checkbox, not Enterprise
4. Add every hostname that will serve the form, including your Forge hostname (for example yoursite.getforge.io) and any custom domain
5. Accept the terms and submit
6. Copy the Site Key and Secret Key

A v2 key will not work.

Step 2: Turn it on in Forge

The form must already exist from a deploy (see About Forms).

1. Open the site in the Forge dashboard
2. Go to the Forms tab and select the form
3. Enable reCAPTCHA
4. Paste the v3 site key and secret key
5. Save

Step 3: Redeploy

Enabling reCAPTCHA in the dashboard does nothing until you deploy again. After you change keys, deploy again.

What you should see

• No “I’m not a robot” checkbox
• Google’s small reCAPTCHA badge may appear in the corner
• A real visitor can submit as usual
• Missing or invalid tokens are rejected by the API (the submission is not stored)

Troubleshooting

grecaptcha is not defined

• The key is v2, Enterprise, deleted, or otherwise not a classic v3 site key — create a new v3 pair
• The hostname is missing from the key’s allowed domains
• You enabled reCAPTCHA but have not redeployed since
• The Google script is blocked (privacy extension, network filter)

Submission fails with a captcha error

• The secret key does not match the site key
• The form was not redeployed after enabling reCAPTCHA, so no token is sent

Do not do this

These do not exist in Forge and will not protect the form:

• reCAPTCHA v2 (“I’m not a robot” checkbox)
• A data-forge-recaptcha attribute — it is ignored
• A g-recaptcha widget, theme, or size options
• Loading api.js yourself or calling grecaptcha in your own script
• reCAPTCHA Enterprise keys with the classic api.js endpoint

Keep the secret key in the Forge form settings only. Never put it in your site HTML.