A PrestaShop captcha is now the basic line of defence against bots that send spam through your contact form, create fake accounts, guess your customers’ passwords and sign strangers up to your newsletter. PrestaShop has no captcha of its own, so every form in your store is open to automated scripts. The most convenient fix is Google reCAPTCHA v3: it is invisible, scores every visit in the background and never asks customers to retype letters or click on pictures of traffic lights. Below we explain what bots do in an online store, how the types of captcha compare and how to add reCAPTCHA to PrestaShop step by step.
Why do bots target online stores?
According to the Imperva Bad Bot Report 2025, automated traffic now makes up 51% of all web traffic, and malicious bots alone about 37%. It is the first time in ten years that automation has overtaken humans, and the report links the growth to AI tools that make bots quicker to build and harder to detect.
A bot does not need to know your store. Scanners crawl the whole web, recognise PrestaShop by its typical addresses (/login, /contact-us, index.php?controller=authentication) and its page markup, then submit forms automatically, hundreds of times a day. A small store with a few orders a week gets the same spam as a large one, because to a bot every unprotected form is an equally easy target.
What do bots do in PrestaShop forms?
Each public form attracts a different kind of abuse. OWASP, the web application security community, lists them in its catalogue of automated threats; the table shows the ones we see most often in PrestaShop stores.
| Form | What the bot does | Effect on your store |
|---|---|---|
| Contact | sends ads, links to scam sites and phishing | a cluttered inbox and Customer Service, the risk of clicking a fake link |
| Registration | creates fake accounts with links in the first and last name fields | junk in the customer list, welcome e-mails sent to strangers |
| Login | tries e-mail and password pairs stolen from other sites (credential stuffing) | hijacked customer accounts with their addresses and order history |
| Password reset | requests hundreds of password reset links | a flood of e-mails to customers, a weaker sender reputation |
| Newsletter | subscribes other people’s addresses, sometimes thousands an hour | a fake subscriber list, spam complaints, your mail landing in junk folders |
The damage to your e-mail is the sneakiest part. Every fake sign-up, password reset and newsletter subscription is an e-mail sent from your domain to someone who never asked for it. When recipients mark these messages as spam, Gmail and Outlook start sending your order confirmations and invoices to the junk folder too.
How to tell if bots are already in your store
- Customers → Customers — sort by registration date. Accounts with links or odd characters in the name, created in batches at the same time, are bots.
- Customer Service — contact form messages in foreign languages, full of links or unrelated to what you sell.
- Advanced Parameters → E-mail — if you keep e-mail logs, sudden runs of welcome and password reset e-mails show up here.
- Newsletter subscribers — in the configuration of the Newsletter subscription module; hundreds of new addresses in one day are almost certainly not customers.
Types of captcha: from distorted text to invisible scoring
A CAPTCHA is a test that tells people and programs apart. Over the years it has moved from simple puzzles to behaviour analysis, because bots — now helped by AI — have learned to solve what was meant to be hard for them.
| Type | What the customer sees | Drawbacks |
|---|---|---|
| Distorted text or a sum | a field to type characters into | tiring for customers, and text recognition software keeps getting better at it |
| Hidden trap field (honeypot) | nothing | stops only the simplest bots that fill in every field |
| reCAPTCHA v2 “I’m not a robot” | a checkbox, sometimes an image challenge | an extra step, and image challenges are annoying, especially on a phone |
| reCAPTCHA v3 | nothing, at most a small badge in the corner | the store has to judge the score itself, and visit data goes to Google |
In a store, every extra step at sign-up or login has a cost: some customers give up when an image challenge appears. That is why a store’s captcha should above all be invisible to people.
Why Google reCAPTCHA v3?
reCAPTCHA is the most widely used captcha service on the web, and we think version 3 is the best choice for a PrestaShop store. Here is why:
- No puzzles. reCAPTCHA v3 never interrupts a purchase. Its script watches in the background how the visitor uses the page, and when a form is sent Google returns a score from 0.0 (very likely a bot) to 1.0 (very likely a person).
- Google’s scale. The score draws on signals from a huge number of sites protected by reCAPTCHA. A bot that attacks thousands of stores leaves traces a single store would never notice on its own.
- Your store decides. You set the score threshold yourself. Google suggests 0.5 to start with, and each form gets its own action name, so a token made for the newsletter will not work at login.
- Single-use tokens. A token expires after two minutes and can be verified only once, so a bot cannot reuse one good token a thousand times.
- A free plan. The Essentials tier is free up to 10,000 assessments a month. An assessment is counted when a form is checked, not on every page view, so the limit leaves plenty of room for most stores.
Other services exist, such as Cloudflare Turnstile and hCaptcha, and they are worth knowing about. reCAPTCHA v3 wins on the combination of invisible scoring, a flexible threshold and the largest pool of data. Just keep in mind that Google’s script sends visit data to Google, so mention it in your store’s privacy policy.
Tip: do not start with a high threshold. Check your forms for a few days without blocking anything, see what scores your real customers get, and only then switch blocking on with a threshold of 0.5.
How to add reCAPTCHA to PrestaShop
Pasting Google’s script into your theme is not enough: a token has to be created each time a form is sent and then verified on the server before PrestaShop saves the message, creates the account or sends an e-mail. The Invisible reCAPTCHA v3 module does this for you on PrestaShop 1.7.8, 8 and 9, including multistore. Setting it up takes a few minutes.
Step 1. Create your keys at Google
Sign in to the reCAPTCHA admin console with a Google account, choose a score-based (v3) key and add your store’s domains, for example yourstore.com; subdomains such as www are covered automatically. Google then shows two keys: the site key and the secret key.
Step 2. Install the module and paste the keys
Upload the ZIP file in Modules → Module Manager → Upload a module and click Configure. Paste both keys into the Google reCAPTCHA keys section and save. The module tests them with Google straight away and tells you whether the key matches your store’s domain, so a typo or a v2 key instead of a v3 one shows up when you save, not when customers can no longer log in.
Step 3. Choose the protected forms
In Protected forms each form has its own switch: contact form, login, registration, password reset and newsletter. Login and registration are protected in the checkout too, guest form included. When a form is stopped, customers keep what they typed in the contact and registration forms.
Step 4. Turn on test mode and pick a threshold
Turn on Test mode for a few days. The module then checks every form but blocks none, and lists the ones it would have stopped, with their score, in Advanced Parameters → Logs. Use that to set the Score threshold (0.1 to 0.9, 0.5 recommended), then turn test mode off. Leave When Google does not answer on “Let the form through”: if Google does not reply within 3 seconds, the customer’s form goes through and the problem is logged.
Step 5. The badge and your privacy policy
Google requires visitors to be told about reCAPTCHA. You can keep the small badge in the corner of the page or hide it; the module then shows Google’s required notice, with links to Google’s privacy policy and terms, under each protected form. Google’s script loads only when someone starts filling in a protected form, so it does not slow down your other pages. Add reCAPTCHA to your privacy policy as well; our privacy policy shows one way to word it. This is general information, not legal advice.
A captcha is not everything
reCAPTCHA protects your forms, but it will not stop scanners looking for known module vulnerabilities, nor attacks on your back office or server. Those threats call for up-to-date software and server-level protection:
- CVE vulnerabilities, signs of a break-in and what to do after an attack are covered in our PrestaShop security guide;
- fail2ban, Cloudflare, rate limits and DDoS protection are explained in How to secure a PrestaShop server;
- if you would rather have someone check your store for you, see our store security audit.
Sources
- Imperva Bad Bot Report 2025 — the share of bots in web traffic.
- OWASP Automated Threats to Web Applications — the catalogue of automated threats, including credential stuffing and account creation.
- Google reCAPTCHA v3 — the score, the 0.5 threshold and token lifetime.
- Google reCAPTCHA FAQ — hiding the badge.
- reCAPTCHA tiers (Google Cloud) — the free assessment allowance.
Frequently asked questions
Will reCAPTCHA v3 make shopping harder for customers?
No. Version 3 shows no puzzles and no checkbox; the scoring happens in the background when a form is sent. A customer with a low score sees a message and can try again, and test mode lets you check your real customers’ scores before you block anything.
Is Google reCAPTCHA free?
The Essentials tier is free up to 10,000 assessments a month. The module asks Google for a score only when a protected form is sent, so the number of assessments is the number of forms sent, not page views. Past the limit Google returns no scores until the end of the month, so keep an eye on the counter in the Google console if your traffic is high.
What happens when Google does not answer?
The module waits up to 3 seconds for a reply. By default it then lets the form through and writes the problem to the PrestaShop logs, so an outage at Google never locks your customers out. If you prefer safety over convenience, set it to block the form instead.
Does reCAPTCHA need cookie consent?
reCAPTCHA sends visit data to Google and sets the _GRECAPTCHA cookie, so it must be described in your privacy policy. Whether separate consent is needed depends on how the rules are read in your country; many stores treat it as a security measure the forms need to work. This is not legal advice; ask a lawyer if in doubt.
Does the module work on PrestaShop 1.7, 8 and 9?
Yes. Invisible reCAPTCHA v3 works on PrestaShop 1.7.8 to 9.x with the native contact form and newsletter modules, and in multistore each shop has its own keys and settings. It does not change PrestaShop’s files and uses no overrides.
Tired of spam in your store? Have a look at the Invisible reCAPTCHA v3 module, or get in touch if you have a question about your store.
Products in this article
