reCAPTCHA & hCaptcha Protection: setup and help

The module can render Google reCAPTCHA v2, reCAPTCHA v3 or hCaptcha widgets. Test every selected form with a valid, a missing and an invalid token: a visible widget alone does not mean the form handler rejects submissions without a valid token.

For selected native login, registration and newsletter forms, missing or invalid CAPTCHA responses prevent submission. Turning CAPTCHA Protection off leaves native registration available.

1. Upload and install the mprrecaptcha ZIP through Modules > Module Manager.
2. Click Configure to open CAPTCHA Settings.
3. Select CAPTCHA Provider.
4. Obtain the matching provider keys for your shop domain. Paste Site Key and Secret Key.
5. Select the forms under Protect Forms.
6. Enable Enable CAPTCHA Protection and click Save.
7. Test valid, missing and invalid tokens on every selected form. Confirm that failed checks prevent the underlying operation.

The CAPTCHA switch starts off. Rendering and verification remain inactive unless both main keys are present. Secret fields are masked in the settings form. You need PHP cURL and an HTTPS connection from your server to the provider verification endpoint.

For example, choose v3, select Contact form, Customer registration and Newsletter subscription, and set the threshold to 0.6. These settings apply v3 protection to the selected forms.

For a v3 fallback test, select v3, use a stricter threshold such as 0.7, fill both fallback v2 keys and enable the fallback switch. The module records a pending challenge for the form after a low score. The next attempt uses the v2 checkbox. A successful fallback clears that pending state.

The module renders through these form hooks where your theme calls them:

{hook h='displayContactContent'}
{hook h='displayCustomerLoginFormAfter'}
{hook h='displayCustomerAccountForm'}
{hook h='displayNewsletterRegistration'}

It also uses displayGDPRConsent for relevant contact placement and a footer injector for recognizable standard forms. Examples include #login-form, #customer-form, .block_newsletter form and controls named submitMessage, submitLogin or submitAccount.

Keep the widget inside the form. Adding a display hook only adds a widget. You still need a working server validation integration.

You can target .mprrecaptcha-widget, .mprrecaptcha-contact, .mprrecaptcha-registration, .mprrecaptcha-newsletter and .mprrecaptcha-login in theme CSS.

Provider scripts use:

https://www.google.com/recaptcha/api.js
https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY
https://js.hcaptcha.com/1/api.js

Google responses use g-recaptcha-response. hCaptcha uses h-captcha-response. The v3 fallback adds mprcaptcha_v2_fallback=1.

The native contact form is checked before submission. A failed CAPTCHA response prevents the message from being sent.

The contact integration also checks submitMessage on the native contact controller during actionFrontControllerSetMedia. If validation fails, it sets the contact honeypot field. Test this path with your installed contact module.

For each selected form:

1. Submit valid data with a valid challenge and confirm success.
2. Submit without a token and confirm that no message, login, account or subscription is created.
3. Repeat with an invalid token.
4. Test mobile and desktop placement.
5. If you use v3 fallback, test the failed first attempt and successful checkbox retry.

If invalid submissions succeed, the form handler needs integration work. Changing the provider or adding a widget does not fix that.

There are no ready-made settings for checkout, password reset, reviews or arbitrary third-party forms. A developer can use renderForForm($formId) and verifyForForm($formId, $token, $ip) for a custom integration. Use a stable form ID containing only letters, digits, underscores or hyphens. The form handler must refuse the operation when verification returns false. Verification returns true while module protection is inactive.

If a widget is absent, check keys, enable state, selected forms, display hooks, selectors and provider requests. If real users fail v3, review the threshold and provider response. If verification fails for everyone, check domain/key type and server HTTPS/cURL access. Use the module's Integrity page for installation checks.

Turn off Enable CAPTCHA Protection and save to stop the module's CAPTCHA rendering and validation. Uninstall through Module Manager to remove its menu and stored settings.

Requires PrestaShop 1.6 or later and PHP 7.1 or later.