Use when risk exists
Contact, signup, password reset, and other public endpoints are common candidates.
Protect Forms with reCAPTCHA
Use reCAPTCHA where abuse risk justifies it, and combine it with real validation and server-side verification instead of treating it as a silver bullet.
Introduction
Section titled “Introduction”reCAPTCHA is useful when a public form attracts enough automated abuse that normal validation is no longer enough. The mistake is treating it as a universal default. In Wappler projects, it should be introduced where the risk justifies the extra friction, then paired with real server-side verification and the rest of your form validation rules.
Keep the server in charge
The browser can present the challenge, but the server must verify the token before trusting the submission.
Add bot protection where abuse is plausible, not automatically on every form.
Keep normal validation rules even when reCAPTCHA is present.
Verify the response server-side before accepting the submission.
Balance protection against the extra friction for legitimate users.
Where reCAPTCHA fits in the stack
Section titled “Where reCAPTCHA fits in the stack”The goal is layered protection, not one magic checkbox.
Start with normal validation
Section titled “Start with normal validation”Required fields, format rules, and business rules still matter. reCAPTCHA protects against abuse, not bad field design.
Different job
Validation protects data quality; reCAPTCHA helps defend the endpoint.
Verify on the server
Section titled “Verify on the server”A client-only integration is incomplete. The server action that receives the form must verify the token and reject the request when verification fails.
Trust boundary
Only the server can decide whether the submission should be accepted.
Use it where it helps
Section titled “Use it where it helps”If a form is internal, authenticated, or low-risk, reCAPTCHA may add more friction than value. Choose it intentionally rather than by habit.
Security with proportion
Protection should match the threat and the user experience cost.
Next steps
Section titled “Next steps”reCAPTCHA is one layer. Strong validation, uniqueness checks, and good submit feedback still carry the everyday form experience.