Settings
The site key and secret key come from your Google recaptcha admin panel. Please note that they need to be created for recaptcha v3. If you already have v2 keys you will need to create new ones.
Badge Position
The options bottomright and bottomleft produce a floating icon pinned to the side of the browser window near the bottom. This expands when hovered over or tapped to expose links to Google's privacy policy and terms. A less in-your-face option is inline which places a badge on the page just above the footer (below the columns on mobile). If you choose to hide this using css and don't make a visible link to G's privacy policy and usage terms you are breaking G's ts and cs.
Scope of Tracking
The default setting (catalog) adds the tracking code to the home page, category, product and manufacturer pages, specials, new products, search and shopping cart. This means that the vast majority of your human visitors will already have been seen across the site before interacting with a form and makes it easier for Google to differentiate them from bots.
The most minimal setting (forms) only loads it on the pages where the forms will be checked and will still be ok but there is more risk of some of your visitors experiencing friction.
The setting all is available for completeness but I have not found a site that needs it.
Add Recaptcha v3 to Forms
Offers you a list of all the catalog files. As far as I have tested, choosing one that doesn't really have a form has no effect but there may be additional page load time and it's possible javascript errors could arise so I wouldn't recommend it. The default setting of Contact Us and Create Account will squash the most annoying bot messages and signups. If you would like to protect customer logins from brute force password guessing attacks (beyond the time-rationed built-in action logging) that is also supported.
Any addon forms will need to fulfil the following criteria for the protection to apply without additional coding. The PWA addon by @raiwa already does and is supported - just select create_account_pwa.php
- form name same as file name without .php (if not there's a mapping)
- includes injectFormDisplay hook within form
- includes injectFormVerify hook within form action processing
Score Threshold
Google's algorithms return a score between 0 and 1 which rates the chance of the interaction being human. They suggest a threshold of 0.5 to start with and to adjust it if needed (which it never seems to be). As the best score they ever give is 0.9, you can temporarily set this to 1 to check that bots are being blocked. If you do, don't forget to set it back!!
Logging
If you turn on logging, a log of the score of each form interaction is recorded. If set, includes the date in the log file name so that a new file is created daily but on all but the quietest sites it's not recommended to leave logging on permanently.
Sample entry:
30-12-20 12:24:29.75277 - using fopen from loginform stdClass Object
(
[success] => 1
[challenge_ts] => 2020-12-30T12:06:20Z
[hostname] => cartmart.uk
[score] => 0.9
[action] => loginform
)
