Bots can create accounts in bulk, spam forms and consume server resources. Google reCAPTCHA adds an assessment layer that separates legitimate user behaviour from suspicious automated traffic.
To integrate it into CMSNT source code, you need to register the correct domain, choose the reCAPTCHA version your source code supports, and enter the issued key pair exactly.
What is reCAPTCHA?
reCAPTCHA is a form protection service from Google. Depending on the version, it can show a challenge, a checkbox, or silently score the risk based on visitor behaviour.
reCAPTCHA reduces spam but does not replace other security measures. The website still needs request rate limits, input validation and server-side monitoring for unusual behaviour.
Steps to create a Site Key and Secret Key
- 01
Sign in to Google reCAPTCHA
Open the reCAPTCHA page with your Google account, then go to the Admin Console.
- 02
Create a new configuration
Click the create icon, enter a recognisable label and choose the reCAPTCHA type that matches your CMSNT source code version.
- 03
Declare the domain
Enter the domain without https:// and without a path. Add subdomains too if the website runs on one.
- 04
Get the key pair
Finish the registration and copy the Site Key and Secret Key. They serve different roles and must not be swapped.
Enter the keys in the CMSNT Admin Panel
Sign in to the admin area, open the security settings or the reCAPTCHA configuration section, then paste the Site Key and Secret Key into the matching fields. Enable the feature, save and clear the cache if your website version caches settings.
Note: The Secret Key is for server-side use only. Never publish it in a tutorial screenshot, a public repository, or a group chat.
How to check that reCAPTCHA works
- Open the sign-up page or the protected form in a private window.
- Submit a valid form and confirm the flow still completes normally.
- Try submitting repeatedly to test the rate limiting.
- Check the logs when the website reports a verification error or shows no challenge.
Common errors and how to fix them
- Invalid domain for site key: the current domain has not been added to the Google configuration.
- Invalid key type: the reCAPTCHA type on Google does not match the type your source code supports.
- Verification always fails: the Secret Key is wrong, the server cannot reach the verification service, or the system clock is off.
- The widget does not appear: the JavaScript file is blocked by CSP, a browser extension or a cache system.
