Spam Protection
Spam Protection stops bots from submitting the lead forms on your site. It uses Google’s reCAPTCHA v3, which works silently in the background by looking at how the visitor behaves, so real visitors never see a puzzle.
It lives in Settings → Sales & Leads → Spam Protection (formerly Recaptcha).
Setting it up
Section titled “Setting it up”- Create a v3 key pair in the reCAPTCHA console (the tab links to it).
- Register every address your forms run on: your published domain (the tab shows it), plus the builder preview and draft-site addresses the tab lists. A key made for the live domain alone fails in the preview.
- Back in Genesis, paste the Site key into Public Key and the Secret key into Private Key.
- Turn on Enable Recaptcha and click Save Changes.
The bottom of the card then says Your lead forms are protected. Forms you add later are protected automatically.
| Field | What it holds |
|---|---|
| Public Key | The Site key. Public by design — it ships in your pages. |
| Private Key | The Secret key. Stored on the server and never sent to a page. Once saved it shows as Saved; click Replace to change it, or Keep the saved key instead to back out. |
Warnings you may see
Section titled “Warnings you may see”- Both keys are needed — only one half of the pair is filled in. Your forms stay open until both are there; they’re never left rejecting real submissions.
- Google does not recognise this Private Key — usually the Site key was pasted into both fields. Your forms were left unprotected rather than rejecting real visitors. Paste the Secret key from the reCAPTCHA console and save again.
- Google has stopped serving this reCAPTCHA key — keys now live in a Google Cloud project, and an older key has to be migrated first. In the reCAPTCHA console choose Migrate to Google Cloud for the key (the keys stay the same), then save here again. Until then your forms either refuse every submission or were left unprotected — the warning says which.
- Some forms still use an older key — save to bring them up to date.
- These keys are already on your project, but your Genesis forms are not using them yet — keys set up earlier in your ESTAGE project settings. Check the pair covers your published domain before you save.
Things worth knowing
Section titled “Things worth knowing”- This is the same reCAPTCHA setting as in your ESTAGE project settings — changing it here changes it in both places.
- reCAPTCHA is free for 10,000 checks a month. Above that, the Google Cloud project needs billing.
- If Genesis can’t update your site’s form code to send the reCAPTCHA check, it leaves protection off and tells you, rather than rejecting every visitor. Try saving again.