1. What this module does
Bots send spam through the contact form, create fake accounts, try passwords on the login form, request password reset e-mails for random addresses and fill your newsletter list with junk. The module protects these five forms with Google reCAPTCHA v3: Google scores every visit in the background, so your customers never see a puzzle or a checkbox, and the module stops the forms sent by bots.
Protected forms: contact form, login (also in the checkout), registration (also the guest and account form of the checkout), password reset request and newsletter subscription.
Works with PrestaShop 1.7.8, 8.x and 9.x (PHP 7.2.5 or newer), with the Classic and Hummingbird themes and with multistore.
2. Installation
- Download the module from My account → Order history at addonspresta.com.
- In your Back Office, open Modules → Module Manager and click Upload a module.
- Drop the
ap_recaptcha_v1.0.0.zipfile and wait for the confirmation. - Click Configure on the module card.
If you have shell access, you can also unpack the zip into modules/ and run
php bin/console prestashop:module install ap_recaptcha from the shop folder.
Get your Google keys
- Open the Google reCAPTCHA admin console, https://www.google.com/recaptcha/admin, and sign in with a Google account.
- Create a key: give it a name, choose Score based (v3) and add every domain of your shop (for example
myshop.com; subdomains are included). - Google shows two keys: the site key and the secret key. Paste them into the module (section 4).
Google gives 10,000 free checks a month per Google Cloud organisation, which covers most shops; above that Google asks you to enable billing in Google Cloud. Keys created earlier have been moved by Google into Google Cloud projects and keep working.
3. How it works
The module adds a small script to the pages of your shop. When a visitor starts filling a protected form in, the script loads Google's reCAPTCHA. When the visitor sends the form, the script asks Google for a one-time token and sends it with the form. Your server then asks Google what the token is worth: a score from 0.0 (surely a bot) to 1.0 (surely a person). Below your threshold, the form is stopped and the visitor sees: "We could not confirm that you are not a robot. Please try again."
What the visitor keeps when a form is stopped:
- contact form and registration — everything typed stays in the form;
- login and password reset — the page reloads with the message, the e-mail has to be typed again;
- newsletter — the message is shown in place of the confirmation.
The module also checks that the token was made for this form and on your shop's domain. A token works only once.
If Google does not answer within 3 seconds, the form goes through by default (or is blocked, if you choose so) and the problem is written to Advanced Parameters → Logs.
The visitor's browser connects to Google only when a protected form is used, not on every page. The module sends Google only the token and your secret key. It does not connect to addonspresta.com.
4. Features and settings
Open Modules → Module Manager → Invisible reCAPTCHA v3 → Configure. The Help box at the top links to this manual, to the module page at addonspresta.com and to our support e-mail.
Google reCAPTCHA keys
Site key and Secret key — paste the keys from the Google console. The secret key is never shown again after saving: leave the field empty to keep it. Until both keys are saved, no form is protected.
When you save, the page takes a test token with your site key and asks Google to check it with your secret key. You then see one of these messages:
- Google accepted the keys — everything works;
- Google did not accept the keys — the secret key belongs to another site key, or the key is not a score-based (v3) key;
- The keys could not be tested — Google gave no token on this page: check the site key and that your domain is in its list of domains;
- Google accepted the keys, but the test ran on… — your Back Office runs on another domain than the shop: make sure the shop domain is in the key's list too.
Protected forms
Contact form, Login, Registration, Password reset, Newsletter — switch off a form you do not want to check. The contact form needs the native Contact form module and the newsletter needs Newsletter subscription; when one of them is disabled, its switch is greyed out.
Behaviour
Score threshold — forms with a lower score are stopped. Google recommends 0.5. A higher value stops more bots and more real customers.
When Google does not answer — Let the form through (recommended: customers can always log in and write to you) or Block the form.
reCAPTCHA badge — Google shows a small badge in the bottom right corner of pages with a protected form. You may hide it; Google then requires its notice ("This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.") under each protected form, which the module adds.
Test mode — checks every form but never stops one. Each form that would have been stopped is written to Advanced Parameters → Logs with the reason and the score. Use it for a few days to choose the threshold, then switch it off.
Skip the contact form for logged-in customers — customers with an account write to you without a check.
5. Multistore
Keys and settings are saved for the shop or shop group selected in the Back Office header. Select All shops to set the same values everywhere, or a single shop to give it its own values — for example its own keys when the shop has its own domain. One licence covers every shop of the installation.
6. Uninstall
Module Manager → Invisible reCAPTCHA v3 → Uninstall removes the module's settings, including your Google keys. To keep them, use Disable instead. The keys stay in your Google console.
7. FAQ and troubleshooting
Do I need to mention reCAPTCHA in my privacy policy? Yes. Google receives the visitor's IP address and sets its own cookies when a protected form is used. You can add, adapted to your policy: "To protect our forms against spam and abuse, we use Google reCAPTCHA (Google Ireland Limited). When you use a form, Google processes data about your device and your use of the page to tell people from bots. Google's Privacy Policy and Terms of Service apply." Ask your adviser whether your cookie banner should list it as well.
Customers say the form shows "We could not confirm that you are not a robot". Turn on Test mode and look at the scores in Advanced Parameters → Logs. If real customers get low scores, lower the Score threshold (for example to 0.3). Customers who use a VPN or block third-party scripts get lower scores.
The contact form shows two messages after a block. The Contact form module adds its own "please try again" message when the module stops a message. This is expected; the customer only has to send the form again.
Spam still arrives. Check that both keys are saved and that Test mode is off. Then raise the Score threshold a little, for example to 0.7. Spam sent through a form of another module is not stopped.
Login in a popup of my theme stopped working. Some themes log customers in through their own popup. Switch Login (or Registration) off, or ask the theme author for a standard login form.
Nothing is checked and there is no badge. Save both keys, then clear the cache in Advanced Parameters → Performance. The badge only appears on pages with a protected form, after the visitor starts filling it in.
I hid the badge, but Google's notice is not under the forms.
The notice is printed by the displayBeforeBodyClosingTag hook, which the Classic and Hummingbird themes have. A custom
theme must include it.
Google problems appear in the logs.
"Google check failed (service…)" means your server could not reach Google: check that it may open HTTPS connections to
www.google.com. "Google check failed (secret…)" means the secret key is wrong: paste it again.
8. Updates and support
Updates are free for life: download new versions from My account → Order history at addonspresta.com and upload them like a new module. Your settings are kept.
Support is included for 12 months from your order: write to mail@addonspresta.com or use the contact form at addonspresta.com (Monday to Friday, 10:00–16:00 CET; we usually answer within 2 business days). Please include your PrestaShop version, the module version and the steps that lead to the problem.