WP Manifestindependent plugin directory
manifest / security / recaptcha-enterprise-integration

reCAPTCHA Enterprise Integration WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Easily integrate Google reCAPTCHA Enterprise with WordPress.

★ 0stars
30release downloads
v1.2.1latest · 23d ago

Install

Download recaptcha-enterprise-integration.zip From the v1.2.1 release on GitHub, Sep 29, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cmfr/recaptcha-enterprise-integration/releases/download/v1.2.1/recaptcha-enterprise-integration.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Easily integrate Google reCAPTCHA Enterprise with your WordPress site for enhanced security and spam protection.


Description

The reCAPTCHA Enterprise Integration plugin allows you to add Google reCAPTCHA Enterprise to your WordPress site for advanced bot protection. It provides a straightforward way to integrate reCAPTCHA verification into your forms, ensuring a secure user experience.

Features

  • Supports Google reCAPTCHA Enterprise
  • Secure token verification via REST API
  • Admin settings page for easy configuration
  • Customizable action labels
  • Error logging for better troubleshooting (with optional debug mode)
  • Simple JavaScript hooks for testing

Installation

  1. Upload the recaptcha-enterprise-integration directory to the /wp-content/plugins/ directory.
  2. Activate the plugin through the 'Plugins' menu in WordPress.
  3. Navigate to Settings → reCAPTCHA Enterprise to configure the plugin.

Configuration

To use this plugin, you'll need the following:

  • Project ID: Your Google Cloud project ID.
  • API Key: A valid API key for the reCAPTCHA Enterprise API.
  • Site Key: The site key associated with your project.

Refer to the Google reCAPTCHA Enterprise Documentation for detailed setup instructions.


Changelog

See CHANGELOG.md for full release history.


Frequently Asked Questions

How do I get my Project ID, API Key, and Site Key?

Project ID:

  1. Go to the Google Cloud Console: Google Cloud Console
  2. Create a new project or select an existing project.
  3. The Project ID is listed at the top of the project dashboard or in the Project Settings.

API Key:

  1. In the Google Cloud Console, navigate to APIs & Services → Credentials.
  2. Click + CREATE CREDENTIALS and select API Key.
  3. Copy the generated API Key.
  4. (Recommended) Click Restrict Key to secure your API key:
    • Set Application restrictions to None (for now).
    • Under API restrictions, select reCAPTCHA Enterprise API.
    • Save the changes.

Site Key:

  1. In the Google Cloud Console, navigate to reCAPTCHA Enterprise.
  2. Click + CREATE KEY.
  3. Choose the appropriate reCAPTCHA type (e.g., reCAPTCHA v3).
  4. Complete the setup and copy the generated Site Key.

Can I use this plugin with reCAPTCHA v2 or v3?

No, this plugin is specifically designed for Google reCAPTCHA Enterprise.

Is my API Key secure?

Yes, the API Key is securely stored in the WordPress database, but you should still follow best practices for securing your WordPress installation.


License

This plugin is licensed under the GNU General Public License v2.0 or later.


Support

For support and feedback, please open an issue on the GitHub repository.

Releases

7 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.1 latest
Sep 29, 2026 23d ago
recaptcha-enterprise-integration.zip
17
Sep 29, 2026 23d ago
tag only
—
Sep 28, 2026 24d ago
tag only
—
Oct 31, 2025 11mo ago
recaptcha-enterprise-integration.zip
10
Oct 31, 2025 11mo ago
recaptcha-enterprise-integration.zip
2
Oct 31, 2025 11mo ago
recaptcha-enterprise-integration.zip
1
Jun 4, 2025 1 year ago
recaptcha-enterprise-integration.zip
0
A- grade

Security

reCAPTCHA Enterprise Integration 1.2.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.2.1
Findings
1
Worst severity
low
Content hash
c51a05ff8315520ad8887afc…

Findings

  • low reCAPTCHA verification fails open on any API error/non-200 response

    insecure_config

    recaptcha_enterprise_passes() returns true (submission allowed) when wp_remote_post errors or the assessments API returns any non-200 status. The token is attacker-supplied; inputs that cause Google to reject the request itself (e.g. oversized or malformed tokens producing 400/413) rather than return valid=false could bypass the CAPTCHA on CF7 and User Registration. It also returns true whenever settings are incomplete.

    inc/token-verification.php:97-101

    Recommendation

    Fail closed on 4xx responses (client-side/token errors) and cap token length; only fail open on network errors/5xx if that tradeoff is explicitly desired and configurable.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.