How to add CAPTCHA to WordPress registration forms

First identify the registration form that creates the accounts. WordPress's built-in form is normally available at /wp-login.php?action=register, but a membership plugin, WooCommerce, or a page builder may use a different form and submission process. A CAPTCHA added to the core WordPress form will not automatically protect every other registration form.

If registration is disabled, go to Settings and then General, enable user registration, and save the change. Check the form while logged out so you see the same flow as a new visitor.

Choose a provider and create a site key and secret key for the exact domain where registration runs. The site key is used in the page integration; the secret key must stay on the server and is used to validate the visitor's response. Google reCAPTCHA supports v2 and v3, while Cloudflare Turnstile uses a sitekey and secret key pair.

Use the provider's test or staging domain separately if you have one. Do not paste the secret key into a public code snippet or expose it in browser JavaScript.

The manual route is possible, but it is a small integration rather than a setting. Use WordPress's register_form action to output the CAPTCHA field or widget, then use the registration_errors filter to read the submitted token and reject the registration when server-side verification fails. WordPress documents these hooks for extending and validating the built-in registration form.

Your code must send the token and secret key to the provider's verification endpoint before allowing the account to be created. For reCAPTCHA, tokens are single-use and expire after two minutes, so verify them during the registration request rather than storing them for later. This route is fine when you maintain a custom plugin, but it can break when the form is supplied by another plugin, the provider script is blocked, or caching and JavaScript optimisation alter the submission flow.

For most sites, install a plugin that explicitly supports the registration form you use. Activate it, enter the site key and secret key in its settings, choose the CAPTCHA version or provider, and enable protection for registration. Settings names vary, so match the option to the actual form rather than assuming that a general login setting also covers sign-up.

If the form comes from UsersWP, choose an integration that supports UsersWP registration rather than one that only targets the core WordPress form. The same rule applies to WooCommerce and membership plugins: check the integration list before relying on the CAPTCHA.

Open a private browser window, load the registration page, and submit one valid registration. Confirm that the CAPTCHA appears, the account is created, and the expected email or approval process still runs. Then submit the form without completing the CAPTCHA and confirm that registration is refused.

When the widget is missing or every submission fails, check the domain attached to the keys, the browser console, caching and script optimisation, and whether the plugin is attached to the correct registration form. Also test on a phone, because an invisible or interactive challenge can behave differently on smaller screens.

The quickest route is to install and configure a registration CAPTCHA plugin instead of writing the integration yourself. For a site using UsersWP, UsersWP ReCaptcha is a suitable choice because it is built around UsersWP registration and login forms and supports reCAPTCHA v2 and v3.

Install it from the WordPress dashboard, activate it, enter the provider keys, enable protection for the UsersWP registration form, and test while logged out. If your site uses a different registration system, choose a plugin that names that system in its supported integrations.