Overview
This guide outlines steps for configuring reCAPTCHA v3 within the Infigo platform to reduce spam signups and addresses potential issues that may arise, such as being locked out due to strict reCAPTCHA thresholds. It explains how to adjust and troubleshoot reCAPTCHA settings to find the right balance between security and usability. Additionally, it covers enabling Email Validation or Admin Approval to further manage new user registrations.
For more tutorials and detailed resources, visit the Infigo Academy.
Key Points and Takeaways
- reCAPTCHA v3 assigns a score (0.0–1.0) to each user; a higher threshold (e.g., 0.7–0.9) is stricter and may block more spam but could affect legitimate users.
- Overly strict reCAPTCHA settings can cause login issues, especially for returning users with saved credentials.
- Email Validation or Admin Approval can further limit spam by preventing unvalidated or unapproved accounts from becoming active.
- Caching may delay immediate effects of reCAPTCHA adjustments; you may need to recycle the application pool or clear browser cache.
Key Settings
A. reCAPTCHA Configuration
Path:
Admin > Configuration > Customer Settings > Customer Settings [Tab] > reCAPTCHA Configuration [Section]
Explanation:
- Site Key / Secret Key: Obtained from Google reCAPTCHA.
- Use reCAPTCHA on Registration/Login/Password Reset/etc.: Enables reCAPTCHA checks for each area you select.
- Score threshold: Sets how strict reCAPTCHA should be. A higher value (e.g., 0.7–0.9) imposes a stricter check; a lower value (e.g., 0.3–0.5) is more lenient.
B. Registration Method
Path:
Admin > Configuration > Customer Settings > Registration [Tab] > Registration [Section] > Registration method [Setting]
Options:
- Standard: Registers the account immediately without validation.
- Email Validation: Sends an activation link; the user must confirm via email to activate the account.
- Admin Approval: An admin reviews each new registration and manually approves it.
5. Scenario-Based Guide
Scenario 1: Configuring reCAPTCHA to Prevent Spam Signups
Problem: Your web forms are receiving excessive spam registrations.
Solution:
- Go to Admin > Configuration > Customer Settings > Customer Settings [Tab] > reCAPTCHA Configuration [Section].
- Enable Use reCAPTCHA on Registration.
- Set a Score threshold (e.g.,
0.5–0.7) to strike a balance between blocking spam and allowing legitimate users.
- Save your changes.
- Monitor signup activity; adjust the threshold up or down if spam persists or real users are blocked.
Tip: Consider also enabling Email Validation or Admin Approval under Admin > Configuration > Customer Settings > Registration [Tab] to ensure new accounts are truly valid before becoming active.
Scenario 2: Troubleshooting Login Issues Due to Strict reCAPTCHA
Problem: After raising the reCAPTCHA threshold (e.g., to 0.9), legitimate logins—including your own admin account—are blocked.
Solution:
- Use another admin account (or a platform admin account) to log in and revert the threshold to a slightly lower value (e.g.,
0.7).
- Alternatively, disable Use reCAPTCHA on Login temporarily, then log in.
- Adjust thresholds again in small increments to see what level is feasible without blocking legitimate users.
- If you cannot access the admin area at all, contact a colleague with admin rights or reach out to Infigo Support for assistance.
6. FAQs
Q: Where can I adjust reCAPTCHA settings?
A: Go to Admin > Configuration > Customer Settings > Customer Settings [Tab] > reCAPTCHA Configuration [Section].
Q: Why am I locked out after increasing the reCAPTCHA score?
A: A high threshold may flag legitimate users as bots. Consider lowering the threshold slightly or disabling reCAPTCHA temporarily.
Q: Will Email Validation prevent spam registrations?
A: Email Validation won’t stop the initial sign-up, but unvalidated emails remain inactive. This helps keep your active user list free of automated accounts.
Q: What if changes to reCAPTCHA settings do not take effect?
A: Caching can delay new settings. Recycle the application pool, clear your browser cache, or try a different browser.
Q: Can I disable reCAPTCHA for specific actions?
A: Yes. Under the reCAPTCHA Configuration, you can individually enable or disable reCAPTCHA on Registration, Login, Password Reset, etc.