How should I configure reCAPTCHA?
Use a matching public site key and secret for the domain, then test the protected form after saving them.
Updated September 28, 2026
Both keys must belong together
The site key is safe to appear in the browser. The secret belongs in protected server settings. If the keys are invalid or for another domain, protected forms can become slow or unusable.
When anti-spam protection fails, fix the keys rather than repeatedly submitting the form.