How to Setup Google reCAPTCHA Protection

Securing your website's authentication points and checkout gates from malicious bots, dictionary attacks, and automated spam submissions is critical for maintaining database health and transaction security. The Wawp plugin integrates directly with Google's official reCAPTCHA framework, allowing you to protect standard WordPress forms, WooCommerce account flows, checkout workflows, and custom Wawp OTP templates with ease.

Core Protection Capabilities

• Multi-Form Coverage: Easily secure Logins, Registrations, Lost Password requests, and WooCommerce Checkouts with global toggle configurations.
• Support for V2 Formats: Choose between V2 Invisible (frictionless verification badge) and V2 Checkbox (traditional "I am not a robot" interactive grid challenge).
• Dynamic RTL Layouts: The invisible badge position adapts dynamically to LTR or RTL languages, displaying in the bottomleft area for Arabic locales or bottomright for English.
• High-Performance Caching: Caches API verification results within the server memory (wp_cache_set in the wawp_database group for 60 seconds) to prevent redundant remote HTTP requests to Google, speeding up multi-step form submissions.
• Smart POST Field Triggers: Restricts token validations exclusively to relevant user-interactive POST requests (e.g. tracking log, username, or billing_email), preventing false blocks on normal page loads.

Step 1: Configuring API Credentials

Before enabling protection on live forms, you must fetch and configure valid credentials from Google:

1. Visit the Google reCAPTCHA Admin Console and register your store domain:
   • Label: Enter your website domain (e.g., mysite.com) to identify the registered site.
   • reCAPTCHA type: Select Challenge (v2), then choose Invisible reCAPTCHA badge (this allows background checks without interrupting users).
   • Domains: Enter your store's primary domain (e.g., mysite.com) where the plugin is active.
   • Google Cloud Platform: Choose your Google Cloud project (e.g., Wawp).

2. Accept the terms of service and click Submit.
3. Copy your generated Site and Secret keys from the confirmation page:
   • Click COPY SITE KEY to copy your public key (allows the Wawp client script to render the badge).
   • Click COPY SECRET KEY to copy your private verification key (allows the backend server to validate tokens with Google).

4. Inside the Wawp reCAPTCHA panel, paste the keys and select your corresponding type.

Step 2: Selecting Protected Locations

Toggle the protection switches to choose exactly where the reCAPTCHA challenges should be displayed and enforced:

1. Login Forms (WP & WC)

• Active Hooks: authenticate (WP core at priority 21) and woocommerce_process_login_errors (WooCommerce core).

• Execution Flow: Enqueues scripts on the standard login screens. If a spambot or brute-force tool attempts to submit a login request without solving the reCAPTCHA token, Wawp returns a recaptcha_failed error: reCAPTCHA verification failed. Please try again.

2. Registration Forms (WP & WC)

• Active Hooks: registration_errors (WP core) and woocommerce_process_registration_errors (WooCommerce core).

• Execution Flow: Displays the checkbox or invisible challenge in sign-up containers. Ensures automated account generation scripts cannot dump fake subscriber profiles into your database.

3. Lost Password Forms

• Active Hooks: lostpassword_post (WP core) and woocommerce_lostpassword_form (WooCommerce core).

• Execution Flow: Protects against bot scripts that trigger-flood your server with massive password reset requests, saving server bandwidth and preventing unwanted SMTP email spikes.

4. WooCommerce Checkout Screen

• Active Hooks: woocommerce_after_checkout_form (for widget rendering) and woocommerce_checkout_process (for verification).

• Execution Flow: Wawp includes a smart detection handler (maybe_render_global_recaptcha). If your checkout is powered by modern Gutenberg Checkout Blocks or custom shortcodes, the plugin detects the checkout context and enqueues the invisible reCAPTCHA directly inside the global wp_footer hook to guarantee seamless, uninterrupted protection.

5. Custom Wawp Forms

• Wawp Login Forms: Protects custom OTP-based or Password-based Wawp authentication screens.

• Wawp Signup Form: Protects the custom Wawp registration block.

Step 3: Verifying Under-the-Hood Logic

When protection is active, Wawp manages script delivery and API synchronization dynamically:

• Selective Script Enqueuing: The Google reCAPTCHA JS file (https://www.google.com/recaptcha/api.js) is only enqueued on active pages (is_checkout() or is_account_page()) or on login_enqueue_scripts to keep page load speeds optimal across the rest of your site.
• Cryptographic Token Verification: Once a form is submitted, Wawp performs a secure remote POST request using wp_remote_post to Google's verification URL: https://www.google.com/recaptcha/api/siteverify
• Result Caching: To prevent database and network latency during complex checkout redirects or password validations, the result is cached inside WordPress transient memory (wawp_recaptcha_[md5-token]) for 60 seconds, bypassing redundant external API calls.