What Advanced Google reCAPTCHA does on your site
Advanced Google reCAPTCHA, published by WebFactory Ltd, adds an “are you human?” test to WordPress forms: login, registration, lost password and comments, plus the WooCommerce, Easy Digital Downloads and BuddyPress forms. The free version offers three kinds of test: Google reCAPTCHA v2 (the checkbox), Google reCAPTCHA v3 (invisible and score-based) and a built-in math captcha that needs no keys and no third-party service.
With reCAPTCHA, the form loads Google’s script from www.google.com/recaptcha, and the plugin checks the answer with Google before it accepts the login or the comment. On v3, the free version rejects any score below 0.5. The plugin also adds login attempt limiting, turned off by default, with a log of lockouts and failed logins.
The model is freemium. The paid version, WP Captcha PRO, uses the same plugin folder and adds hCaptcha, Cloudflare Turnstile, an icon captcha, a firewall with cloud blocklists, country blocking, email-based two-factor authentication, temporary access links and login page customization. In June 2026, the free version jumped from 1.35 to 5.39 to match PRO’s numbering: the jump is not a rewrite.
Which sites Advanced Google reCAPTCHA suits best
- Blogs flooded with spam comments: the captcha stops bots before the comment is saved.
- WooCommerce or Easy Digital Downloads stores hit by automated account sign-ups: one setting covers login, registration and, if needed, checkout.
- BuddyPress communities that want to filter sign-ups without another plugin.
- Small sites with no budget that want a captcha and login limiting in the same free plugin.
It is the wrong tool for a contact form: Contact Form 7, WPForms and Gravity Forms are not on the list of supported forms, and their own captcha setting, or a plugin such as Simple Cloudflare Turnstile, handles them better. It is also a poor fit for a site that does not want to send data to Google (the plugin itself labels reCAPTCHA “Not GDPR Compatible”) or a site that already limits logins with another security plugin: two lockout systems get in each other’s way.
Advanced Google reCAPTCHA strengths and limitations
Strengths
- Three free captchas. reCAPTCHA v2, reCAPTCHA v3 and a math captcha with no third-party service, whichever fits the site.
- Broad coverage in one plugin. WordPress, WooCommerce, Easy Digital Downloads and BuddyPress forms, each with its own toggle.
- Login limiting included. Adjustable threshold, time window and lockout length, with a log of lockouts and failures.
- Keys tested before saving. The “Verify Captcha” button keeps you from saving invalid reCAPTCHA keys that would break the login.
Limitations
- No contact forms. Only WordPress, WooCommerce, Easy Digital Downloads and BuddyPress forms are supported.
- Non-Google options are PRO only. hCaptcha, Turnstile, the icon captcha and an adjustable v3 score are paid features.
- IP address read without proxy support. The plugin trusts the address of the connection to the server: behind a proxy that does not pass on the real address, a lockout can hit the proxy’s address.
- Settings in English only. Option labels are not translatable and stay in English on a non-English site.
- Several fixes in 2026. Three security advisories in 2026, two of them for PRO, call for close attention to updates.
The Advanced Google reCAPTCHA settings we recommend
The screen is under Settings > Advanced Google reCAPTCHA. Keep an administrator session open in another browser while you test.
| Setting | Recommended value | Why |
|---|---|---|
| Captcha Captcha > Captcha | “Google reCAPTCHA v3”, or “Built-in Math Captcha” if you do not want Google | The captcha is disabled by default. v3 asks nothing of visitors; the math captcha sends no data to a third party. |
| Captcha Site Key and Captcha Secret Key Same screen | Keys created for the same reCAPTCHA version, then “Verify Captcha” | Without a successful check, the plugin does not save the captcha settings. |
| Login Form, Registration Form, Lost Password Form, Comment Form Captcha > Where To Show | On (default) | These are the usual bot targets; the login toggle also covers WooCommerce and Easy Digital Downloads. |
| WooCommerce Checkout Form Same screen | Off, unless you face a wave of fraudulent orders | A captcha at checkout adds a step. If you turn it on, place a full test order. |
| Login Protection Login Protection > Basic | On, if no other plugin already limits logins | Off by default. It blocks an IP address after repeated failures. |
| Max Login Retries Same screen | Between 3 (default) and 5 | Low enough to slow bots, high enough for a few typos. |
| Retry Time Period Restriction and Access Lock Length Same screen | 5 and 60 minutes (default) | A one-hour lockout slows brute force without locking out a careless user for long. |
| Show Credit Link Same screen | Off (default) | The “form protected by” link under the form does nothing for your visitors. |
Before you turn on Login Protection behind Cloudflare or another reverse proxy, make sure the server receives visitors’ real addresses (see Cloudflare in front of WordPress); our guide to limiting login attempts explains how to pick thresholds.
- You logged in from a private window with the captcha active.
- A test comment and a lost password request go through without errors.
- In the Activity tab, the IP address of a deliberate failed login is your own.
- Your privacy policy mentions reCAPTCHA if you use Google.
Patched vulnerabilities in Advanced Google reCAPTCHA
WPScan and Patchstack list six patched vulnerabilities, all low to medium severity for the free version:
- CVE-2024-12034: a locked-out bot could unblock its own IP address, fixed in 1.26.
- CVE-2025-1262: math captcha bypass, fixed in 1.28.
- CVE-2025-2074: limited SQL injection with a subscriber account, fixed in 1.30.
- CVE-2026-5411 and CVE-2026-5415: arbitrary file upload and authentication bypass by a subscriber in WP Captcha PRO, fixed in 5.39. The vendor states the free version was not affected.
- CVE-2026-100518: unauthenticated login protection bypass, fixed in 5.41.
The useful step: turn on automatic updates for the plugin, and on PRO make sure the license actually receives new versions. Hiding the plugin with WP Masquerade Pro, which removes its folder and its script IDs from your pages, makes it harder for bots hunting its vulnerabilities to spot, but Google’s script stays visible and hiding is not a fix.
What WP Masquerade hides for Advanced Google reCAPTCHA
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Advanced Google reCAPTCHA: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- files served by the vendor
www.google.com/recaptcha
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Advanced Google reCAPTCHA FAQ
Should I pick reCAPTCHA v2 or v3?
v3 is invisible and does not bother visitors, but the free version fixes the minimum score at 0.5. v2 shows a checkbox, which is more visible and often helps if bots get past v3. Google keys are specific to each version.
Is Advanced Google reCAPTCHA GDPR compliant?
With reCAPTCHA, visitor data goes to Google, and the plugin itself flags both options as not GDPR compatible. The built-in math captcha uses no third-party service; our article on GDPR and security logs helps with login limiting, which records IP addresses.
I am locked out after too many failures. How do I get back in?
On the lockout screen, enter an administrator’s email address: an unblock link valid for one hour is sent there, at most three times per hour. Otherwise, rename the wp-content/plugins/advanced-google-recaptcha folder over FTP to deactivate the plugin.
Does the plugin protect my contact form?
No: it covers login, registration, lost password, comments and the WooCommerce, Easy Digital Downloads and BuddyPress forms. For a contact form, use the captcha built into your form plugin or one of the options on our WordPress anti-spam page.