CAPTCHA is one of the best tools WordPress administrators and website owners have at their disposal in their fight against spam, such as spam comments and fake user registrations. Just like every other tool, sometimes it needs to be sharpened and serviced. Some TLC goes a long way in helping you keep the CAPTCHA 4WP plugin performing admirably against spam.
If you have ReCAPTCHA configured on your WordPress website, but you’re still getting spam, this article is for you. We will start with a brief introduction and some background information into how CAPTCHA works before delving into step-by-step instructions of actions you can take to limit spam.
Introduction and background information
ReCAPTCHA is a CAPTCHA service provided by Google. CAPTCHA plugins that use the ReCAPTCHA service act as a connector to the Google ReCAPTCHA service – which essentially does the bulk of the work,
CAPTCHA is an acronym, which stands for Completely Automated Public Turing test to tell Computers and Humans Apart. This means that the ReCAPTCHA service is effectively trying to determine if a visitor is a computer or a person through a test. The test is ‘rigged’ in favor of humans – which is what we ultimately want. Computers, however, keep getting smarter, and sometimes they are able to pass off as humans and ace the test. To learn more about CAPTCHA, what it is and how it works, read What is CAPTCHA.
ReCAPTCHA comes in three different versions:
- ReCAPTCHA – V2 I’m not a robot
- V2 Invisible
- V3.
V3 is the latest version, launched in 2018. The V2’s were first launched in 2014. Each of these versions includes a different type of test, with the test that’s run by V3 being more technologically advanced. Furthermore, it even lets you set the test’s pass mark yourself. This control allows you to tweak the test, making it more difficult for computers to pass the test. This is what we will be configuring in the next section.
How to limit spam
We will now look at how we can limit spam by using CAPTCHA 4WP.
As mentioned earlier, V3 is the latest version of ReCAPTCHA. We will switch to this version so that we can gain control over the test’s pass mark; making it more difficult for spam to get through. This version also requires less user interaction, helping you decrease friction with your users and visitors without compromising on security.
Step 1: Check which version you’re running.
The first step you need to undertake is to check which ReCAPTCHA version you’ve configured on your website. As mentioned earlier, V3 is the newer version. If you’re running an earlier version, make sure you switch to V3.
You can easily do this by selecting the V3 option from the reCAPTCHA type drop-down menu.
Step 2: Get a new key pair
You will need a Secret Key and a Site Key for ReCAPTCHA V3. You can do this through the Google ReCAPTCHA admin console.
Step 3: Set the pass mark
As mentioned earlier, CAPTCHA is a test, and like other tests, it has a pass mark. Adjusting the score can make it more difficult for computers to pass as humans.
In CAPTCHA 4WP, we can do this through the Captcha Score option. By default, the score is set at 0.5, which equates to 50%. Increase the value to make the test more difficult to pass.
Increase the value by 0.1 and re-assess the situation. It is not advisable to increase the score by multiple points without first seeing how this affects spam and users.
Step 4: Enable CAPTCHA on all pages
The last step that we need to take is to enable CAPTCHA on all pages. This setting loads the ReCAPTCHA script, allowing the ReCAPTCHA service to better understand how the visitor/user is behaving across the website. Enabling this option should yield better results.
Under the v3 Script Load option, select All Pages.
Once ready, make sure you save the settings by clicking the Save Changes button.
Next Steps
If you’re still getting a high number of spam messages, consider following these steps next:
Smart fields
Smart fields are additional fields that you can add to your form that make it even more difficult to get through when used in conjunction with CAPTCHA.
Honeypot fields essentially are hidden fields that only a bot would see. If an input is registered in the field, the form will not be sent, helping you reduce instances of automated spam. Form plugins may have this included as a feature – all you need to do is enable it.
Test questions are simple questions that a human can answer, but a bot would struggle with. Test questions are included as mandatory fields in the submission form and can ask questions such as How many legs does a puppy have? Or 5 + 2 =.
Google reCAPTCHA dashboard
The Google reCAPTCHA dashboard offers a number of different stats that can help you determine what is going on, including passed and failed login requests and the number of sessions completed.
Contact Melapress
If you’re getting stuck, remember we are just one customer support request away. You can always open a support ticket and try to include as much information as possible in your message. Screenshots are especially helpful since these may allow us to spot configuration optimization issues that once fixed, can help you improve the spam situation.
Keep in mind that no solution is 100% foolproof, especially when it comes to internet and computer security. Spammers, like hackers, are always looking for ways to circumvent the checks and balances we put in place to keep our websites safe. This means that some spam might still get through, even with reCAPTCHA enabled; however, using the latest version will ensure this is kept to a minimum.
