reCAPTCHA v3 and Fewer Traffic Lights

A test nobody sees

Google released reCAPTCHA v3 yesterday. Like the earlier versions, it tries to tell people from automated programs on your forms. Unlike them, it never asks anyone to prove anything.

No box to tick, no grid of photographs, no hunting for traffic lights, crosswalks or storefronts. The visitor fills in the form and sends it.

Behind the scenes, v3 looks at how the visitor uses the site and returns a score between 0.0 and 1.0, where 1.0 means very likely a person and 0.0 very likely a bot.

What it does not do is decide anything. That part is now the site's job.

How it differs from the checkbox

Version 2, the familiar one, puts an I'm not a robot checkbox on the form. Many visitors tick it and pass; the ones it doubts get the picture grid.

Its invisible variant shows nothing until it becomes suspicious, then shows the same grid.

Version 3 has no grid to fall back on. It hands your site a number, and the form, the plugin or the code behind it has to act on that number.

That makes it gentler for visitors and more demanding to set up. It needs its own keys and its own code, so a form built for version 2 cannot simply be switched over.

What the site must do with the score

• Verify it on the server, where a visitor cannot fake it.
• Check the action name matches the form that was sent.
• Request it at submission, since each token expires within minutes.
• Choose a threshold, starting where Google suggests, at 0.5.
• Decide what low scores get: a review folder, a second step, or a delay.
• Log the scores for a few weeks before blocking anything.

The fifth is where most of the thought goes. A score is a probability, not a verdict, and some real people will score low for reasons neither you nor they can see.

Low scores on a contact form

For a login page, Google suggests asking a doubtful visitor for an extra step, such as a code sent by email. A contact form has a simpler option.

Accept the message and file it in a review folder instead of the inbox. Somebody checks the folder daily, and real enquiries caught there get a reply, a little late, instead of no reply at all.

What a contact form should never do is reject a low score with an error. The visitor cannot retry their way to a better score, and has no idea why the form refused them.

Where the score comes from

Version 3 judges visitors by how they behave across the site, not only on the form. Google recommends loading it on other pages too, so it has more to go on.

That means more information about your visitors' behaviour goes to Google, from more of your pages. It belongs in your privacy policy, named plainly, alongside your analytics and any advertising tags.

It also puts a small reCAPTCHA badge in a corner of every page where it loads, which is worth checking against any chat bubble or back-to-top button already sitting there.

A worked example

A children's coding school runs after-school classes, weekend workshops and summer camps, and takes registrations through forms on its website. Most parents fill them in on phones.

The forms used the reCAPTCHA checkbox, and many parents were sent to the picture grid, sometimes twice. Some gave up and emailed instead.

One mother who uses a screen reader phoned to say she could not get through it at all.

Spam still arrived, less of it, from senders the checkbox let through.

The school's web company is moving the forms to v3 this week, alongside a hidden honeypot field and server checks for links and submission speed.

Low scores will go to a review folder, and scores will be logged for a month before any threshold is tightened.

An accessibility gain, with a condition

Picture puzzles are among the most common barriers on small business forms. People who are blind, people with low vision and people with unsteady hands all meet them at the last step.

Version 3 removes the puzzle entirely, which is a real gain for all of them.

The condition is the fallback. If low scores lead to a second step, that step has to work without sight, without precise movement and without a time limit, or the barrier has simply moved somewhere less visible.

A review folder asks nothing of the visitor, which is why it suits a contact form.

Plugins, keys and the setup

Most sites use reCAPTCHA through a form plugin or a form service. Those need to support v3 before it can be used, and many will add it over the coming weeks and months.

The server check, the threshold and the review folder are decisions about your business, not settings to leave at whatever a plugin chooses.

Ask whoever maintains your forms what your plugin supports, and what it would do with a low score.

What v3 does not do

It does not stop a person typing spam by hand, and it does not replace the quieter checks on the server: a honeypot field, a limit on links, a minimum time to fill in the form.

Nor does it encrypt anything. A form on a page still served over plain HTTP sends its contents as readable text, score or no score, and Chrome now marks it in red as soon as anyone types.

The counter-case

Not every form needs reCAPTCHA at all. A contact form receiving a few spam messages a week may be well served by a honeypot field and server checks alone, asking nothing of anyone.

The checkbox version still works, and Google has announced no end to it. A site whose version 2 setup troubles nobody can move when its form plugin supports v3, rather than this week.

Where a puzzle is stopping real customers, though, v3 is worth the setup: verified on the server, low scores to a review folder, and nothing left for a visitor to solve.

This month

1. Send your own form on a phone.
2. Ask whether your plugin supports v3.
3. Register new v3 keys with Google.
4. Verify every score on the server.
5. Send low scores to a review folder.
6. Log scores before tightening any threshold.
7. Name reCAPTCHA in your privacy policy.

Step five is the one that protects real customers. A threshold will always misjudge somebody, and a folder that a person reads turns that mistake into a late reply rather than a lost enquiry.

Why the page around the form needs HTTPS first is covered in the red not secure label.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.