# Adding captcha to your checkout flow Source: https://support.storeconnect.com/articles/adding-captcha-to-your-checkout-flow · Last modified 21 August 2026 StoreConnect supports Google reCAPTCHA v3 on the checkout flow to help prevent spam and bot activity. reCAPTCHA v3 works invisibly in the background, scoring user behavior and validating the result server-side, without presenting any challenge to your shoppers. :::note reCAPTCHA v3 is built in to the checkout flow (customer information step) with no theme changes required. It can also be enabled on other pages such as registration, login, and custom forms with a small theme edit. See [Enable reCAPTCHA on other pages](#enable-recaptcha-on-other-pages). ::: ## Prerequisites - A Google account to access the [reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin) - Access to your StoreConnect admin (to set store variables) - Your store's domain (for example, `shop.example.com.au`) ## Step 1: Create your reCAPTCHA keys 1. Go to [the reCAPTCHA admin console](https://www.google.com/recaptcha/admin/create) and sign in with your Google account. 2. Enter a label to identify this key, such as your store name. 3. Select **reCAPTCHA v3** as the type. 4. Add your store domain (for example, `shop.example.com.au`). Keys are domain-specific, so add any additional domains you want to protect. 5. Accept the terms and submit. 6. Retrieve your **Site Key** and **Secret Key** from the confirmation screen, or from **Settings > Keys** in the Google Admin Console. :::note The **Site Key** is public and used in the browser. The **Secret Key** is private and used server-side to verify scores. Only the Site Key is visible on your storefront, so do not expose your Secret Key publicly. ::: ## Step 2: Add store variables in StoreConnect In your StoreConnect Store record, go to **Store Variables** and create the following three variables. All three store variables are required. If `captcha_type` or `captcha_secret_key` are missing, the reCAPTCHA script loads in the browser but the server does not verify token scores, and your Google Admin Console shows the key as Unprotected. | Name | Key | Description | Required? | |------|-----|-------------|-----------| | Captcha key | `captcha_site_key` | Your reCAPTCHA v3 Site Key (public key from Google) | Required | | Captcha secret | `captcha_secret_key` | Your reCAPTCHA v3 Secret Key (private key from Google) | Required | | Captcha type | `captcha_type` | Must be set to `recaptcha` | Required | Once these variables are set, StoreConnect automatically injects the reCAPTCHA script into the checkout page and handles token generation and server-side verification, so no theme changes are required. ## Step 3: Verify the setup ### Browser verification After setting the store variables, attempt a checkout on your store. On the customer information step: 1. Open browser developer tools (F12) and go to the **Console** tab. 2. Confirm there are no reCAPTCHA-related errors (for example, `grecaptcha is not defined` or `Invalid site key`). 3. The reCAPTCHA badge icon should be visible in the bottom-right corner of the screen on the customer information step. ### Google Admin Console verification 1. Log in to the [reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin) and select your registered key. 2. After a real checkout is completed, activity data should appear in the dashboard within 24 to 48 hours. 3. If the console shows "Unprotected - Your key is requesting tokens but isn't requesting scores", this means `captcha_secret_key` is missing. :::note There is a delay before activity appears in the Google Admin Console, even after a successful checkout. If no data appears after 48 hours and your store variables are correctly set, confirm that the domain registered in Google matches your store's domain exactly. ::: ## Enable reCAPTCHA on other pages The store variables set in Step 2 are all that is required for checkout. To enable reCAPTCHA on pages beyond the checkout flow, add the following snippet inside the form in the relevant theme file: ```liquid {%- if store_variables["captcha_site_key"] %} {%- endif %} {% render "captcha", action: "YOUR_ACTION_LABEL" %} ``` Replace `YOUR_ACTION_LABEL` with a descriptive value for the page, such as `register` or `login`. This label appears in the Google Admin Console to identify where interactions are coming from; it does not affect how the token is generated or validated. The following pages and their corresponding theme snippet files support this approach: | Page | Theme snippet file | Suggested action value | |------|--------------------|------------------------| | Registration (`/account/register`) | `snippets/account/register/form` | `register` | | Login (`/account/login`) | `snippets/account/login/form` | `login` | | Forgot password (`/account/forgot-password`) | `snippets/account/forgot-password/form` | `forgot-password` | | Resend confirmation (`/account/resend-confirmation`) | `snippets/account/resend-confirmation/form` | `resend-confirmation` | | Custom form | Template using `{% form "custom-form" %}` | any descriptive label | After adding the snippet to a page, visit that page and confirm the reCAPTCHA badge is visible in the bottom-right corner of the screen. :::note The Google Admin Console only shows the status for the checkout page captcha. For other pages it just shows a shield to indicate the pages are protected. ::: ## Troubleshooting | Symptom | Resolution | |---------|------------| | Google Admin Console shows 'Unprotected' warning | The `captcha_secret_key` store variable is missing. | | `grecaptcha is not defined` in browser console | The reCAPTCHA script is not loading. Check that `captcha_site_key` is set. Do not add the reCAPTCHA script manually to your theme, as it is injected automatically and adding it again will cause it to load twice. | | `Invalid site key` error in browser console | The value in `captcha_site_key` is incorrect. Retrieve the Site Key (not the Secret Key) from the Google Admin Console under **Settings > Keys**. | | reCAPTCHA works on checkout but not on other pages | Other pages require a theme snippet. See [Enable reCAPTCHA on other pages](#enable-recaptcha-on-other-pages). | | Domain mismatch or key not authorized | Ensure the domain registered in Google matches your live store URL exactly (for example, `shop.example.com.au`). | | Everything connected but no status showing in the console for page captchas | The full status only shows for the checkout page. | ## reCAPTCHA failure message to shoppers Any bots that are detected are shown an error message after trying to complete the customer information step at checkout: > We have detected unusual activity, please try again or contact us for support. ## Manage your reCAPTCHA score reCAPTCHA v3 assigns a score between 0.0 (likely a bot) and 1.0 (likely a human) to each interaction. You can monitor your score distribution and adjust thresholds from the [reCAPTCHA v3 Admin Console](https://www.google.com/recaptcha/admin). If you find that legitimate shoppers are being blocked, review your score data in the Admin Console and consider whether your threshold needs adjustment. :::note If your Site Key changes (for example, you register a new key), update the `captcha_site_key` store variable immediately. An outdated or incorrect key will break bot protection. ::: ## Privacy compliance Once you are using reCAPTCHA, your shoppers' data is sent to Google for verification. If you are using StoreConnect's [Cookie management and privacy compliance](cookie-management-and-privacy-compliance) feature, you should update this as well. --- ## Follow StoreConnect - [Email Newsletter](https://getstoreconnect.com/c/lp-newsletter) - [LinkedIn Newsletter](https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7444956928444862464) - [YouTube](https://www.youtube.com/channel/UCngKdP2x8l1wcbAKW3tvU8g) - [LinkedIn](https://www.linkedin.com/company/storeconnect) - [X / Twitter](https://x.com/storeconnecthq) ## Popular Links - [Partners](https://getstoreconnect.com/partners) - [News](https://getstoreconnect.com/articles/news) - [Events](https://getstoreconnect.com/articles/events) - [Feature Comparison](https://getstoreconnect.com/how-we-compare) - [Download a free trial](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FMkeKUAT) - [Book a Demo](https://getstoreconnect.com/contact) ## Documentation - [Help documentation](https://support.storeconnect.com/help-documentation) - [AI agents](https://support.storeconnect.com/ai) - [Videos & tutorials](https://support.storeconnect.com/videos-tutorials) - [Developer reference](https://support.storeconnect.com/developer-reference) - [Release notes](https://support.storeconnect.com/release-notes) - [Troubleshooting](https://support.storeconnect.com/troubleshooting) - [Trust Center](https://trust.getstoreconnect.com/) - [Status Page](https://status.storeconnect.com/) ## Contact - info@getstoreconnect.com - US +1 415 745 3230 - AUS +61 2 8365 2308 100 S Ashley Dr, Suite 600-2461 Tampa FL 33602-600 USA Level 22, Sydney Place 180 George Street Sydney, NSW, 2000, AUS --- StoreConnect Support — https://support.storeconnect.com/articles/adding-captcha-to-your-checkout-flow