Understand the implementation of reCAPTCHA

This document shows the implementation path of reCAPTCHA to protect your websites, mobile applications, APIs, or content served by a web application firewall (WAF).

reCAPTCHA workflow for websites

The following illustration provides a high-level overview of the implementation of reCAPTCHA on websites:

A workflow diagram that shows the implementation workflow for websites

The implementation workflow for websites.

Setting up reCAPTCHA on websites involves the following steps:

  1. Create reCAPTCHA keys: Choose the reCAPTCHA key type that is best for your use case and create keys.

  2. Integrate reCAPTCHA with your website: To collect information about the user actions and send it to reCAPTCHA, install the keys that you created on your web pages by using the reCAPTCHA JavaScript API.

  3. Integrate reCAPTCHA with your backend: From your backend server, create assessments to verify the token sent by reCAPTCHA and assess the risk. Interpret the assessment scores and the associated risk, and define how to handle users—for example, allow the user to sign in only when the score is high, which indicates low risk.

After you set up reCAPTCHA, we recommend that you annotate the assessments whenever you have more information about the user interactions. This helps reCAPTCHA to tune your site-specific model and improve the risk detection.

You can also set up additional security to protect user accounts and payment workflows on your websites.

For instructions, see Set up reCAPTCHA on websites.