# Spam Protection

> Stop bots from submitting your forms with Google reCAPTCHA v3 — getting keys, registering domains, and what each warning means.

Source: https://knowledge.estage.com/project-settings/spam-protection/
Part of the ESTAGE knowledge base (https://knowledge.estage.com). Full corpus: https://knowledge.estage.com/llms-full.txt

---
**Spam Protection** stops bots from submitting the lead forms on your site. It uses Google's
**reCAPTCHA v3**, which works silently in the background by looking at how the visitor behaves,
so real visitors never see a puzzle.

It lives in **Settings → Sales & Leads → Spam Protection** (formerly *Recaptcha*).

## Setting it up

1. Create a **v3** key pair in the reCAPTCHA console (the tab links to it).
2. Register every address your forms run on: your published domain (the tab shows it), plus the
   builder preview and draft-site addresses the tab lists. A key made for the live domain alone
   fails in the preview.
3. Back in Genesis, paste the **Site key** into **Public Key** and the **Secret key** into
   **Private Key**.
4. Turn on **Enable Recaptcha** and click **Save Changes**.

The bottom of the card then says **Your lead forms are protected**. Forms you add later are
protected automatically.

| Field | What it holds |
| --- | --- |
| **Public Key** | The *Site key*. Public by design — it ships in your pages. |
| **Private Key** | The *Secret key*. Stored on the server and never sent to a page. Once saved it shows as **Saved**; click **Replace** to change it, or **Keep the saved key instead** to back out. |

## Warnings you may see

- **Both keys are needed** — only one half of the pair is filled in. Your forms stay open until
  both are there; they're never left rejecting real submissions.
- **Google does not recognise this Private Key** — usually the Site key was pasted into both
  fields. Your forms were left unprotected rather than rejecting real visitors. Paste the
  **Secret key** from the reCAPTCHA console and save again.
- **Google has stopped serving this reCAPTCHA key** — keys now live in a Google Cloud project,
  and an older key has to be migrated first. In the reCAPTCHA console choose **Migrate to Google
  Cloud** for the key (the keys stay the same), then save here again. Until then your forms
  either refuse every submission or were left unprotected — the warning says which.
- **Some forms still use an older key** — save to bring them up to date.
- **These keys are already on your project, but your Genesis forms are not using them yet** —
  keys set up earlier in your ESTAGE project settings. Check the pair covers your published
  domain before you save.

## Things worth knowing

- This is the same reCAPTCHA setting as in your ESTAGE project settings — changing it here
  changes it in both places.
- reCAPTCHA is free for 10,000 checks a month. Above that, the Google Cloud project needs billing.
- If Genesis can't update your site's form code to send the reCAPTCHA check, it leaves protection
  off and tells you, rather than rejecting every visitor. Try saving again.