reCAPTCHA v3 on a WordPress contact form

Keys, and the move to Google Cloud

reCAPTCHA keys are now managed inside Google Cloud projects. The free tier covers a limited number of checks per month for each organisation; above it, Google refuses further checks until the next month or until billing is set up. A busy site — or a spam run — can reach that limit, and a form that treats Google's refusal as “spam” then starts rejecting everybody.

Choosing the threshold

Google's own suggestion is to start at 0.5. Lower lets more through; higher catches more bots and more real people using VPNs or privacy tools. A contact form usually wants to be forgiving, because a lost customer costs more than one spam message.

In Mailbag Contact Form

Choose Google reCAPTCHA v3 under Mailbag → Settings → Spam and paste your site key and secret; the secret is masked after saving. The script loads only on pages with a form. Then:

• A score of 0.5 or more is accepted as a normal entry.
• A score below 0.5 is saved as spam, with the reason and without a notification, and kept under Spam for 30 days so you can check it.
• If Google can't be reached, or refuses because the monthly limit is used up, the entry is accepted and marked unverified. A notice tells you when Google rejected your secret or the limit was reached.

The honeypot, time trap and per-address limit keep working the whole time, so the quiet checks still stop the everyday bots while you sort out the keys.

Bringing keys over from Contact Form 7

Contact Form 7 stores its reCAPTCHA keys in its own settings. When you import CF7 forms into Mailbag, the importer offers to take those keys over — and does so only if you say yes. More in reCAPTCHA keys after switching.