Stop form spam in PrestaShop with reCAPTCHA v2, v3 or hCaptcha protection
reCAPTCHA & hCaptcha Protection checks PrestaShop form submissions and rejects automated spam before the store processes it. Setup requires two keys from your chosen provider and the protection switch.
Google reCAPTCHA and hCaptcha provide the challenge service through free accounts with pass and fail statistics. Google offers a visible checkbox or invisible scoring; hCaptcha supplies another provider choice for the same forms.
You protect contact, login, registration and newsletter forms separately, select the provider and adjust scoring strictness. A low score triggers a checkbox on the next attempt, requiring a separate pair of fallback keys. Each shop keeps its own settings, no theme edits are needed, and the module stores no visitor data or message contents.
Suspicious submissions face a verified challenge while genuine customers retain a second route through a low score.
Summary of what the module offers
reCAPTCHA & hCaptcha Protection places a spam barrier on the forms of a PrestaShop store and confirms every submission with the chosen provider before the store acts on it.
- Four protected forms: contact, customer login, registration and newsletter, each switched on or off separately.
- Three protection options behind one setting: the Google checkbox, invisible Google scoring and hCaptcha.
- A second chance instead of a refusal: a low invisible score leads to a checkbox challenge, not a lost customer.
- No theme work: the module finds the forms by itself, in new and old themes.
- A light footprint: the provider loads only on pages that carry a protected form when you choose so.
- Server-side certainty: every check is confirmed with the provider, and nothing about the visitor is stored.
Which forms stop receiving spam?
You pick the protected forms from a checklist: the contact form, customer login, account registration and the newsletter signup. Each one is a separate decision, so a store that only suffers contact spam protects exactly that and nothing more.
The check happens twice. The visitor completes the challenge in the browser, and the module then confirms the result directly with the provider on the server, together with the visitor’s address. A bot that skips the widget or replays an old answer is rejected before PrestaShop processes the form.
What that settles: the inbox carries only real questions, the customer database is not padded with invented accounts, the newsletter list keeps the reputation your campaigns depend on, and automated login runs hit a wall before they reach a password.
What does a genuine customer notice?
With invisible scoring the answer is nothing. Google rates each visitor in the background and the form behaves as it always did. One strictness value decides how suspicious a visitor must look before the store reacts, and you adjust it in the settings.
When a real person scores badly, for example on a shared computer, in a privacy browser or on a first visit, the module offers another attempt at the form. It remembers the situation for that form and presents a checkbox challenge on the next attempt, using a separate pair of keys made for that purpose. The customer ticks the box and continues; the memory clears itself after the successful check.
That step is the difference between a spam filter and a lost sale. Competing setups stop at a hard refusal; here the doubtful visitor is asked one small question instead of being shown the door.
Which provider fits my store?
Three protection options sit behind one setting: Google reCAPTCHA as a visible checkbox, Google reCAPTCHA as invisible scoring, and hCaptcha. Switching provider later is one change in the settings; the forms and the rest of the configuration stay as they are.
Check the chosen provider's free-plan limits against your store's usage. The account at the provider supplies the two keys, shows how many checks passed and failed, and carries the challenge itself, so the hard work of telling humans from machines rests with a service built for exactly that.
hCaptcha matters to merchants who keep Google out of their storefront for privacy reasons: the protection level stays, the provider changes.
Will it work with my theme and my other modules?
No template is edited. The module places the widget through the standard positions of the store and, where a theme lacks them, finds the forms on the page by their shape: it recognises the contact, login, registration and newsletter forms of current and older themes and attaches the protection there.
It also behaves well in company. On the contact page it steps back when the standard contact module already shows the widget, so the customer never sees two challenges. Forms created by other modules join the same protection, and in a multistore every shop keeps its own keys, its own provider and its own list of protected forms.
What about speed, privacy and setup?
After installation the module stays inactive and says exactly what it needs: the two provider keys and the protection switch. The settings screen shows each missing piece with its field next to it, so the first working check is minutes away, not an afternoon.
A dedicated option keeps the provider off pages that carry no protected form, so product pages and categories load without any third-party addition. Verification with the provider travels over an encrypted connection, and the module keeps nothing: no message contents, no check results, no visitor data.
-
Referencemprrecaptcha
-
Version1.3.1
-
Improvements123
-
Released
-
Updated
-
PrestaShop CompatibilityPS 1.6 – 9.x
-
Pricing ModelOne-time Purchase
-
Module TypeFront & Back-office
-
GDPR RelevantYes
-
Business GoalLegal & Compliance
-
External Account NeededYes
-
Module ComplexityFeature-Rich Module
-
Customer Journey StageConvert to Buyers
-
Works With PlatformGoogle Services
No product reviews yet
Write a Review
Customer Reviews for PrestaShop Modules and Support
Be the first to share your experience with this product.
Have a question about this product?
Our experts are here to help. Ask anything about installation, compatibility, or specifications.
Ask a question
1350
questions
9
categories
Will I get a duplicate CAPTCHA on my contact page if I use PrestaShop's native contact form?
No. The module detects when PrestaShop's native contactform module is active and already rendering in the contact area, and in that case it does not add a second widget there. Instead it places the CAPTCHA through the contact page's GDPR-consent area, so you get one CAPTCHA in the right spot rather than two stacked widgets.
This handling is specific to the contact form. The login, registration and newsletter forms each render their own CAPTCHA through their dedicated hook, and every form has its own on/off switch so you protect only the ones you want.
Which CAPTCHA providers are supported, and how do reCAPTCHA v2, v3 and hCaptcha differ?
You can choose one of three providers in the module settings: Google reCAPTCHA v2 (the familiar "I'm not a robot" checkbox), Google reCAPTCHA v3 (invisible, score-based) or hCaptcha (a privacy-focused checkbox alternative). One provider is active at a time and it applies to every form you protect.
reCAPTCHA v2 and hCaptcha challenge the visitor with a widget, while reCAPTCHA v3 runs silently in the background and returns a score from 0 to 1. With v3 you also set a score threshold (default 0.5) so you can tune how strict the invisible check is without switching provider.
How does the reCAPTCHA v3 score threshold work, and can wrongly flagged visitors still submit?
reCAPTCHA v3 returns a score between 0 and 1 for each submission. The module compares that score with the threshold you set (default 0.5): submissions that meet or beat it pass, lower ones are treated as automated and stopped. Raising the threshold is stricter, lowering it is more permissive.
Because invisible scoring can occasionally misjudge a real customer, you can enable an optional checkbox fallback. When a v3 submission scores below the threshold, the visitor is asked to complete a reCAPTCHA v2 checkbox (using a separate pair of v2 keys) to prove they're human and continue, so genuine shoppers aren't dead-ended.
What data does the module send to Google or hCaptcha (GDPR)?
When a protected form is submitted, the module sends the CAPTCHA response token, your secret key and the visitor's IP address to the provider's verification endpoint (Google's or hCaptcha's siteverify service) to confirm the response is valid. The provider's own JavaScript widget also loads in the visitor's browser, exactly as it does on any site that uses reCAPTCHA or hCaptcha.
The module itself doesn't store the token, the score or the visitor's data in your database. Because a third-party service is involved, using CAPTCHA is GDPR-relevant, so mention your chosen provider in your privacy policy; on the contact page the widget is rendered through the GDPR-consent area for that reason.
Do I need a Google reCAPTCHA or hCaptcha account, and what happens before I add the keys?
Yes. The module doesn't run its own CAPTCHA service, it connects to Google or hCaptcha, so you create a free account with your chosen provider and generate a site key and secret key, then paste both into the module settings.
Protection stays completely inactive until the module is enabled and both keys are filled in. Before that, no widget is rendered and no submission is checked, so an incomplete setup can never block or break your customer-facing forms. The back office also shows a notice reminding you which keys are still missing.
Which forms can reCAPTCHA & hCaptcha Protection protect?
reCAPTCHA & hCaptcha Protection adds CAPTCHA validation to the PrestaShop front-office forms that bots actually target, so spam submissions and automated account creation get stopped before they reach you. Each form has its own on/off toggle, so you can protect login but leave the contact form open, or the other way round.
Protected forms (per-form toggle):
- Contact form
- Customer login
- Customer registration / account creation
- Newsletter subscription
The registration widget is rendered through the customer account form hook. The GDPR consent placement is contact-form specific: it is limited to the contact controller/contactform module and renders the contact CAPTCHA widget there.
Providers (one active at a time, switchable without reinstalling):
- Google reCAPTCHA v2 - the classic I am not a robot checkbox.
- Google reCAPTCHA v3 - invisible; it scores each interaction and you set the score threshold (default 0.5; higher is stricter) below which a request is rejected.
- hCaptcha - a privacy-minded alternative for stores that prefer not to send traffic data to Google.
Set-up is all in the Back Office: provider dropdown, site key and secret key fields, per-form toggles, the v3 threshold, and configuration checks that warn you when keys are missing so protection is not silently off. Compatible with current PrestaShop versions.
The install defaults are intentionally inactive until configured: ENABLED=0, provider recaptcha_v2, empty site and secret keys, protected forms set to contact,registration, v3 threshold 0.5, v3-to-v2 fallback off, and conditional script loading off. After you add keys and enable the module, validation runs server-side before the relevant form action continues.
For v3, the module posts the token to Google's verification endpoint and compares the returned score with your threshold. If optional v2 fallback is enabled and fallback keys are present, a low v3 score stores a short-lived fallback flag and asks the visitor to complete a v2 checkbox challenge instead of failing immediately. hCaptcha uses the hCaptcha verification endpoint and reads h-captcha-response; Google providers read g-recaptcha-response.
Theme coverage has two layers. The module uses normal PrestaShop form hooks where they exist, and a footer injector can place a widget before submit buttons for common legacy selectors when a theme does not expose the ideal hook. Conditional script loading can keep provider scripts off pages without protected forms, but it defaults off for legacy theme compatibility.
See the full walkthrough on the reCAPTCHA & hCaptcha Protection product page.
How do I enable HTTPS / SSL on my PrestaShop store?
To enable SSL in PrestaShop, install a certificate on your server first (most hosts offer free Let's Encrypt certificates), then in Shop Parameters → General switch on Enable SSL and Enable SSL on all pages, and clear the cache.
A few things that trip people up:
- Mixed-content warnings mean some resources still load over HTTP, check your theme and modules for hardcoded
http://URLs. - Don't touch
PS_SHOP_DOMAINorPS_SHOP_DOMAIN_SSLunless you know exactly why. Getting them wrong can lock you out of the back office.
Once HTTPS is live, you can harden it. MPR Security Revolution can add an HSTS header (Strict-Transport-Security) so browsers refuse to fall back to HTTP, and an upgrade-insecure-requests policy to help mop up mixed content. It does not enable SSL for you, that's the PrestaShop setting above, it secures the connection after it's on.
HSTS has a sharp edge: the module only sends Strict-Transport-Security when the request is HTTPS, and browsers will remember it for the configured max age. Start without includeSubDomains or preload until every subdomain, CDN hostname and legacy redirect is confirmed on HTTPS. The module's default security-header config leaves HSTS and CSP off until you enable them, with CSP report-only available for testing before enforcement.
To verify the change, check both schemes from outside the server:
curl -I https://example.com
curl -I http://example.comThe HTTPS response should show the expected security headers, and the HTTP response should redirect cleanly to HTTPS. If mixed content remains, fix hardcoded asset URLs at the theme/module level; security headers can help, but they are not a replacement for correcting broken resource URLs.
v1.0.152025-12-31
- Maintenance release: refreshed bundled shared libraries and module icon
Loading full changelog...
Works Well With reCAPTCHA & hCaptcha Protection
Modules our team genuinely pairs with this one, and exactly why each belongs in the same setup.
Governance
A merchant running reCAPTCHA & hCaptcha Protection is reducing spam and automated submissions on storefront forms bots target, like contact, registration and login. Cutting bot noise matters most where customers actually submit information, and a richer contact setup gives bots more forms to probe.
Better Contact Form is a separate tool that lets you create multiple storefront forms for support, returns, quote requests or business messages, with multilingual text, custom fields and required validation. It builds the enquiry forms, while the captcha layer screens them.
Used together, Better Contact Form provides the structured enquiry forms your team needs and the captcha protection filters automated junk before it reaches you. A merchant gets clearer customer enquiries with less spam, two complementary tools where one shapes the forms and the other reduces bot submissions, without claiming any given message is guaranteed genuine.
Complement
A merchant using reCAPTCHA & hCaptcha Protection is cutting automated abuse on registration and login forms, which are exactly the points where account creation happens. Reducing bot signups is one side of registration friction; the human effort of choosing a password is another the captcha tool does not touch.
Automatic Customer Password is a separate tool that fills password and confirmation fields with generated values, applied to registration, checkout or both, with hidden or visible field options, so shoppers do not stop to invent a password. It smooths the field, not the abuse.
Run alongside each other, the captcha layer filters automated submissions while the password tool removes the password pause for genuine shoppers. A merchant gets fewer bot accounts and an easier path for real ones, two complementary tools where one screens out automated traffic and the other reduces friction for the people who should get through.
Governance
A merchant running reCAPTCHA & hCaptcha Protection focuses on a specific defence, filtering spam and automated submissions on storefront forms with reCAPTCHA v2, v3 and hCaptcha. Form spam is one threat surface; the broader security posture of the store, monitoring and cleanup is a much larger concern the captcha tool does not address.
Security Revolution is a separate tool that brings protection, monitoring and operational cleanup into one back-office workflow, reducing damage from risky requests, spam, fake registrations and suspicious traffic before they consume staff time. It handles the wider security picture.
Used together, the captcha layer screens the specific forms bots target while Security Revolution covers monitoring and operational defence more broadly. A merchant gets focused form protection plus a wider security workflow, two complementary tools where one filters automated form abuse and the other manages the store's overall security work.
Governance
A merchant using reCAPTCHA & hCaptcha Protection keeps automated submissions off the forms bots target, so adding any new public form raises the question of whether it too will attract spam. An on-page product enquiry form is exactly such a new submission point.
Ask About Product is a separate tool that adds an Ask a question button near product details, opening a popup form with name, email and message fields so shoppers can ask about fit or buying doubts without leaving the page. It creates the enquiry channel with its own submission protection, complemented by provider-verified captcha checks.
Run alongside each other, Ask About Product captures genuine pre-purchase questions while the captcha layer reduces the automated junk that public form would otherwise collect. A merchant gets a useful enquiry route with less spam, two complementary tools where one opens the conversation and the other filters bot submissions, without implying every message is guaranteed genuine.
No known issues
There are currently no open or resolved issues registered for this module.
30 days return right
Easy return - no questions asked
Plug & Play Modules
Install, set up and take profit
Dedicated Support First
Priority Help & Satisfaction Over Sales
You might also like
More From This Category
Who builds and maintains this module
Built and maintained by David Miller and mypresta.rocks. David Miller has worked with PrestaShop since 2013, and the company behind this shop has been registered since 3 December 2018. Every module in this catalogue is our own work, so your questions to support reach the people who wrote the code. The changelog on this page lists every update with its date.