reCAPTCHA Integration

reCAPTCHA is a bot detection service provided by Google. SentinelSecurity supports both reCAPTCHA v2 and v3 to prevent automated attacks on the login form.

Why reCAPTCHA Is Necessary

Brute-force protection blocks based on failure counts, but attackers can bypass these limits by rotating through multiple IP addresses. reCAPTCHA directly determines whether access comes from a bot or a human, providing an IP-independent defense layer.

Differences Between v2 and v3

Feature	reCAPTCHA v2	reCAPTCHA v3
User Interaction	Requires checkbox click	No interaction required (invisible)
Detection Method	Challenge display	Behavioral score (0.0–1.0)
UX	Requires user action	User doesn't notice
Recommended Use	Form submission confirmation	Login page protection
Recommendation	○	◎ (Recommended)

v3 is recommended. It requires no additional user action, analyzing behavioral patterns in the background to identify bots.

Obtaining API Keys

Visit the Google reCAPTCHA Admin Console
Log in with your Google account
Click + (Register a new site)
Enter the following:

Label: Your site name (any name)
reCAPTCHA type: Select v3 (recommended)
Domains: Your site's domain name (e.g., example.com)

5. Click Submit

Copy the displayed Site Key and Secret Key

Configuration

Navigate to SentinelSecurity → Login Security → reCAPTCHA
Toggle the switch to Enabled
Select v2 or v3 under Version
Enter the Site Key and Secret Key
For v3, set the Score Threshold (default: 0.5)
Click Save

About the Score Threshold (v3)

v3 returns a score from 0.0 (likely a bot) to 1.0 (likely a human).

Threshold	Strictness	Description
0.3	Lenient	Block only when bot probability is high
0.5	Standard (recommended)	Balanced detection
0.7	Strict	Broadly block suspicious access
0.9	Very strict	May also block legitimate users

Recommended: 0.5 (default). Lower to 0.3 if false positives are frequent, or raise to 0.7 if security is a priority.

Supported Forms

reCAPTCHA works with the following login forms:

WordPress default login form
BuddyPress login form
bbPress login form
WP-Members login form

Using with CSP (Content Security Policy)

When using reCAPTCHA, the following domains must be allowed in the CSP header. SentinelSecurity automatically adds these to the CSP.

script-src: https://www.google.com/recaptcha/, https://www.gstatic.com/recaptcha/
frame-src: https://www.google.com/recaptcha/
connect-src: https://www.google.com/recaptcha/

reCAPTCHA Integration