How to Add Captcha to Elementor Form

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. In practice, it is a security challenge that distinguishes real visitors from automated bots before a form can be submitted.

The three types you are most likely to encounter:

• Image recognition: The original format. Users identify objects in a grid of photos (traffic lights, crosswalks, fire hydrants). Works because computers struggle to interpret images contextually the way people do.
• Checkbox (reCAPTCHA v2 “I’m not a robot”): Mostly invisible. It analyzes mouse movement and browsing behavior. Only displays an image grid when the behavior looks suspicious. Most real visitors just click the checkbox and move on.
• Invisible score-based (reCAPTCHA v3): Runs entirely in the background without any visible widget. It assigns each user a trust score based on site behavior. The form owner sets a threshold: submissions that score below it are blocked silently or flagged for review. Visitors with normal behavior never see any challenge at all.

Elementor Pro supports both reCAPTCHA v2 and v3 natively, at no cost beyond the Elementor Pro license.

Bots do not wait. An unprotected contact form on a live website typically receives its first automated submission within 24 to 48 hours of being indexed. Without any protection, even a small site can receive hundreds of fake submissions per week.

The practical consequences go beyond a noisy inbox:

• Email deliverability: A high volume of outgoing notifications triggered by spam submissions can flag your sending domain as suspicious and affect your ability to reach real contacts.
• CRM and lead data: If your form feeds a CRM, fake entries pollute your lead records and make conversion metrics unreliable.
• Server load: At high volumes, form submissions triggered by bots consume server resources. On shared hosting this matters.
• Phishing risk: Some bots use contact forms to test email harvesting by sending messages with external links. An open form is an invitation.

CAPTCHA blocks all of this at the entry point, before any submission reaches your inbox, CRM, or server logs.

To add reCAPTCHA to an Elementor Pro form, you register your site with Google and connect it to Elementor. Here is the setup from start to finish.

Step 1: Get your reCAPTCHA keys from Google
Go to google.com/recaptcha and sign in with your Google account. Click the plus (+) button to register a new site. Enter a label (your site name), and choose your reCAPTCHA type:

• v3 (recommended for most sites): Invisible and score-based. Visitors never see a challenge. Best for sites where you do not want any friction for real users.
• v2 “I’m not a robot” checkbox: Shows a checkbox. Use this if v3 causes false positives, blocking legitimate visitors with strict browser privacy settings.

Add your domain, accept the terms of service, and click Submit. Google gives you a Site Key and a Secret Key. Copy both.

Step 2: Connect the keys in Elementor
In your WordPress admin, go to Elementor > Settings > Integrations. Scroll to the reCAPTCHA section (v2 or v3 depending on what you chose). Paste the Site Key and Secret Key into the fields and click Save Changes.

Step 3: Add the reCAPTCHA field to your form
Open the page with your Elementor form in the editor. Click on the form widget, open Form Fields, and click + to add a new field. Set the Type to reCAPTCHA (or reCAPTCHA V3). Drag it to the bottom of the form, just above the Submit button.

Step 4: Test the form
Preview the page, fill in the form as a normal visitor, and submit it. If the submission goes through, the setup is working. If it fails, check that the domain in your Google reCAPTCHA console matches your live domain exactly, including whether or not you have www.

If you are not using Elementor Pro
The free Elementor form widget does not support reCAPTCHA. The most common free alternative is Contact Form 7 combined with Akismet and a honeypot field, which provides solid spam protection without needing Elementor Pro.