reCAPTCHA v3 for shop account forms

This article will help you protect your TronShop account forms against bots with Google reCAPTCHA v3

Bots sometimes fill in shop forms automatically, for example to create fake accounts or to send many password-reset requests. Google reCAPTCHA v3 checks in the background whether a real person is using the form. Your customers do not have to click on pictures or tick a box.

reCAPTCHA is off by default. You switch it on with your own keys from Google.

Where in admin: Settings → Integrations → Recaptcha V3

On this page

• Which forms are protected
• Getting the keys from Google
• Switching reCAPTCHA on in your shop
• Choosing the minimum score
• What your customers notice
• Changing the keys or switching reCAPTCHA off
• Troubleshooting
• Need help?

Which forms are protected

When reCAPTCHA is on, it checks these storefront forms:

• Registration – creating a new customer account;
• Forgot password – requesting a password-reset e-mail;
• Password reset – setting a new password from that e-mail;
• Complete registration – finishing an account from the “complete your registration” e-mail;
• Adding a new person to the company in the customer account (editing an existing person is not checked).

Other forms, such as the contact form and inquiry forms, are not checked by reCAPTCHA.

Getting the keys from Google

You need a Google account. The steps below are a short outline; Google may change its screens over time.

1. Open the Google reCAPTCHA admin console and sign in.
2. Create a new site (key). Give it a name you will recognise, for example your shop name.
3. Choose reCAPTCHA v3 (score based). Keys for reCAPTCHA v2 (“I’m not a robot” checkbox) do not work in TronShop.
4. Under Domains, add every domain your shop is reachable on, for example myshop.com. If customers also use other domains of your shop (for example a separate domain for another country), add those too.
5. Submit the form. Google shows two keys: the site key and the secret key. Keep the page open, or copy both keys somewhere safe.

Switching reCAPTCHA on in your shop

1. In your TronShop admin go to Settings → Integrations → Recaptcha V3. The page is called Recaptcha V3 Settings.
2. Turn on the Active switch. The fields below it become editable.
3. Paste the site key from Google into Site Key.
4. Paste the secret key from Google into Secret Key.
5. Check the Minimum Score. 0.5 is filled in by default and is a good start (see Choosing the minimum score).
6. Click SAVE.

reCAPTCHA works only when Active is on and both keys are filled in. While Active is on, you cannot save with an empty key: SAVE stays disabled and the page tells you what is missing. If the page ever shows Active switched off although you switched it on earlier, a key is missing. reCAPTCHA is then not working in your shop. Fill in both keys, turn Active on again and save.

After saving, the Secret Key field shows only asterisks (************************). This is on purpose: the secret key is never shown again. To keep the stored secret key, leave the asterisks as they are when you save. To replace it, delete the asterisks and paste the new key.

You need the Manage settings permission to change this page.

Choosing the minimum score

For every protected form, Google gives the visitor a score from 0 (very likely a bot) to 1 (very likely a person). If the score is lower than your Minimum Score, the shop refuses the form.

Start with 0.5 (Google’s recommendation). Change it in small steps (0.1) only when you have a reason: lower it if customers tell you they cannot register, raise it if fake accounts keep appearing. The score must be between 0 and 1.

What your customers notice

• Usually nothing. The check runs in the background when they submit the form.
• If the check fails (for example the score is too low), the form shows CAPTCHA validation failed. Please try again.
• If our server cannot reach Google at that moment, the forms keep working without the check, so a Google outage does not stop your customers from registering. The same applies when Google rejects your Secret Key (for example a typo): the forms keep working, but without protection, so test your keys after saving (see the example above).
• If the visitor’s browser blocks Google’s reCAPTCHA script (some ad blockers, privacy extensions or company networks do this), the form waits a few seconds, is then sent without the check and is refused with CAPTCHA validation failed. Please try again. Ask them to allow Google reCAPTCHA for your shop or to try another browser.

Changing the keys or switching reCAPTCHA off

• New keys: go to Settings → Integrations → Recaptcha V3, paste the new Site Key, replace the asterisks in Secret Key with the new secret key, and click SAVE. The site key and the secret key must belong to the same key in Google.
• Switch off: turn Active off and click SAVE. The forms then work without reCAPTCHA.

Troubleshooting

Need help?

If the protected forms stop working after you switch reCAPTCHA on and the steps above do not help, turn Active off so your customers can use the forms again, and contact our Support Team.