Why use reCAPTCHA v3 with Crunchforms
- reCAPTCHA v3 provides a frictionless, score-based spam protection system from Google that does not interrupt users with challenges.
- Because Crunchforms already handles server-side validation of the reCAPTCHA token and score, you only need to execute reCAPTCHA on the front end and configure your keys and score threshold.
- Once configured, any submission via Crunchforms that fails token validation or scores below your configured threshold will be rejected automatically — minimal extra code required.
Prerequisites
Before you start:- Read through Google’s reCAPTCHA v3 Intro and Guides to understand how it works and how scoring is used.
- You must have a Google account and access to the reCAPTCHA Admin Console.
- You must have a Crunchforms form set up (you already have a form-endpoint configured).
- Access to edit the HTML (or embed) of your form page to add the reCAPTCHA script and token handling.
Step 1: Create your reCAPTCHA v3 keys (in Google Admin Console)
Follow Google’s reCAPTCHA documentation for this part:- Go to the reCAPTCHA Admin Console and sign in.
- Click + Create (or + button) to register a new site.
- Provide a descriptive Label for your site.
- Select reCAPTCHA v3 as the type.
- Add the domain(s) where your forms will be hosted.
- Accept the terms of service and click Submit.
- You will be shown a Site key (public) and a Secret key (private).
Step 2: Configure Crunchforms to use your reCAPTCHA v3 key
In your Crunchforms dashboard, edit the form settings for the form you want to protect:- Navigate to your dashboard
- Open the form’s settings by selecting Edit Form Settings from the menu next to the form, or from the same menu inside the form’s submission view.
- Go to the Spam protection section.
- Under Captcha, select reCAPTCHA v3.
- Enter your Secret key from Step 1. If a key is already saved, it shows as
••••••••plus its last four characters — press Replace key to enter a new one. - Set the minimum Threshold score (0.0 – 1.0). Submissions scoring below this value are rejected;
0accepts every score. - Set an Action — this is required. It must match the action your page passes to
grecaptcha.execute(), e.g.submitForm. - Save your changes.
With reCAPTCHA v3 selected, Crunchforms expects a token on every submission to this form, validates it, and checks the score. If validation fails, or the score is below your threshold, the submission is rejected. Select None if you do not want to enforce reCAPTCHA v3 here.
Step 3: Embed reCAPTCHA v3 on your form page
Refer to Google’s Client-side integration guide for full details. In summary:-
Load the reCAPTCHA v3 script (typically in
<head>): -
Add a callback function to handle the token.
-
Add attributes to your html button.
Because Crunchforms handles the server validation step and score checking, you just need to ensure the token is generated on the client side and included in your submission under
g-recaptcha-response. Crunchforms will validate the token with Google, inspect the score and action, and only accept submissions that meet or exceed your configured threshold.reCAPTCHA v3 Form Example
recaptcha-form.html
Use with Single Page Applications, React, and Next.js
You can Programmatically invoke the challenge to have more control over when reCAPTCHA runs. Below is an example using Next.JS.Next.JS reCAPTCHA v3 Example
RecaptchaForm.js
You must ensure that the token provided by reCAPTCHA is ultimately included in the form submission under the
g-recaptcha-response or recaptchaToken field name so that Crunchforms can validate it server-side.References
Next steps
Explore advanced configurations and features:Set up a Honeypot Field
Get easy protection against simple bots using a hidden field
Set up Cloudflare Turnstile
Advanced bot protection using Cloudflare Turnstile
Set up Google Recaptcha
Advanced bot protection using Google reCaptcha v3
Add additional email addresses
Add and verify additional email addresses to receive form submission notifications
Need Help?
Get Support
Send us a note