Comment spam stops at the checkbox.Verified on your server, not in the browser.
TryToFix reCAPTCHA for Comments puts Google’s reCAPTCHA v2 Checkbox on your WordPress comment form and checks every response with Google before a comment is saved.
Leave a Reply
Illustration only. On your site, visitors see Google’s own widget, placed just above the Post Comment button.
Three steps from install to protected comments
- Get free keysRegister your domain with Google as reCAPTCHA v2 “I’m not a robot” and copy the site key and secret key.
- Paste and enableOpen Settings → TryToFix reCAPTCHA, add both keys, tick Enable and save. The plugin won’t switch on without valid-looking keys.
- Test with a commentOpen a post, tick the box and submit. A missing or failed check shows a clear message and the comment is not saved.
Built the WordPress way
Server-side verification
Each token is sent to Google from your server with wp_remote_post(), once per submission. Timeouts and malformed replies count as failures.
Secret key stays private
The secret is never printed in your pages, JavaScript or REST responses, and never shown again in the settings screen.
Works with GeneratePress
It uses standard WordPress hooks only, so no theme files are edited and GeneratePress Premium isn’t required. Other themes that use comment_form() work too.
Light on your pages
Google’s script and one small stylesheet load only on pages that show a protected comment form. No frameworks, fonts or extra libraries.
Logged-in commenters too
Protect everyone by default, or let logged-in users skip the checkbox with one setting.
Settings you can trust
Built on the Settings API with capability checks, sanitized inputs and a Test Configuration button that checks connectivity and your secret key without pretending to be a full test.
What it does, and what it doesn’t
reCAPTCHA is one layer of spam protection, not a guarantee. Keep comment moderation on.
- It protects the standard WordPress comment form. Custom comment forms, AJAX comment plugins such as wpDiscuz, and REST or XML-RPC comments are not covered.
- In threaded comments, moving the form with Reply can reset the widget, so a visitor may need to tick it again.
- The widget is about 304px wide. On very narrow screens it scrolls inside its own box instead of hiding Google’s branding.
Questions
Do I need a Google account?
Yes. You create the key pair for free in the Google reCAPTCHA admin console, and you must choose reCAPTCHA v2 Checkbox. The plugin doesn’t work without valid keys.
What about privacy?
Loading reCAPTCHA means Google may process technical data under its own Privacy Policy and Terms. Update your site’s privacy policy as appropriate. The plugin stores no tokens and collects no extra commenter data.
The checkbox doesn’t show up. What should I check?
Make sure reCAPTCHA is enabled with both keys saved, comments are open on the post, and your theme calls comment_form(). Also check that an ad blocker or caching plugin isn’t blocking Google’s script.
Can I remove everything when I uninstall?
Yes. Tick “Remove data on uninstall” in the settings and deleting the plugin also deletes its saved settings.
Install it in a few minutes
- Version
- 1.0.0
- WordPress
- 6.0 or higher
- PHP
- 7.4 or higher
- License
- GPL-2.0-or-later
In WordPress go to Plugins → Add New Plugin → Upload Plugin, choose the ZIP and activate it.
Download the plugin (ZIP)reCAPTCHA is a service of Google. This plugin is independent and not affiliated with Google.