How to Add reCAPTCHA v3 to a Static Form Without a Server

A honeypot field stops the lazy bots. It does nothing against a script that fills every field on the page, including the hidden one, because it never learned to skip it. That's the gap reCAPTCHA v3 closes, and on a static site — no server, no session, no cookie you control — wiring it in looks harder than it is.

reCAPTCHA v3 is a Google service that scores every page interaction from 0.0 to 1.0 without showing a checkbox or an image challenge. SimpleForm is a hosted form backend for static websites: you point a form's action attribute at a SimpleForm endpoint and skip writing server code entirely. Its Pro and Agency plans support reCAPTCHA v3 on top of the honeypot and rate-limiting that run on every plan, and this article walks through setting it up end to end.

What Is reCAPTCHA v3 and How Is It Different From a Checkbox?

Older reCAPTCHA versions (v2) ask a visitor to click a checkbox or pick out traffic lights in a grid of photos. reCAPTCHA v3 skips the interaction entirely. It watches how the page loads and how the visitor moves through it, then hands your form a numeric score between 0.0 and 1.0 — 0.0 meaning the traffic looks automated, 1.0 meaning it looks human.

That score arrives as a token, not a checkbox state. Your form submits the token alongside its normal fields, and something on the receiving end — your own server, or your form backend's server — asks Google to verify the token and return the score. Nothing in the visitor's browser ever sees that number.

How Do You Get a reCAPTCHA v3 Site Key and Secret Key?

Every reCAPTCHA integration starts with a key pair from Google, regardless of what processes the score afterward.

1. Go to the reCAPTCHA admin console and sign in with a Google account.
2. Register a new site, choose reCAPTCHA v3 as the type, and enter every domain the form will live on.
3. Accept the terms and submit — Google issues two keys: a public site key and a private secret key.
4. Keep the site key for your HTML. Keep the secret key out of any file a browser can request; it belongs only in a server-side setting.

If you're adding reCAPTCHA v3 to a SimpleForm endpoint, the secret key goes into that form's dashboard settings, not into your static site's code. Only the site key ships to the browser.

How Do You Add the reCAPTCHA v3 Script to a Static HTML Form?

Load Google's script and generate a token right before the form submits:

1. Add <script src="https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY"></script> to the page.
2. On submit, call grecaptcha.execute('YOUR_SITE_KEY', {action: 'submit'}), which resolves to a token string.
3. Write that token into a hidden field named g-recaptcha-response before the form data posts.

A minimal version looks like this:

document.querySelector('#contactForm').addEventListener('submit', async (e) => {
e.preventDefault();
const token = await grecaptcha.execute('YOUR_SITE_KEY', {action: 'submit'});
document.querySelector('#recaptchaToken').value = token;
e.target.submit();
});

The field name matters. A backend that expects g-recaptcha-response — which is what SimpleForm's Pro and Agency plans verify against your secret key — will silently skip verification if the token lands in a differently named field.

How Google Scores Each Submission

Once a token reaches a verifier, Google returns a JSON response containing the score and the action name you specified. What happens next is a threshold decision your backend makes, not something Google decides for you.

Google's official reCAPTCHA v3 documentation recommends 0.5 as a starting threshold and lets you adjust it per action once you have real traffic data to look at.

If you're verifying the token yourself rather than through a form backend, the check is one POST request: send secret, response (the token), and optionally the visitor's IP to https://www.google.com/recaptcha/api/siteverify. Google replies with a JSON body containing success, score, and the action name you set client-side — comparing that action name against what you expected stops a token generated for one form being replayed against another. Every score is scoped to the action, so a contact form and a newsletter signup on the same page can carry different thresholds if one deserves more scrutiny than the other.

Turning It On for a SimpleForm Endpoint

Writing your own verification call — checking the token against Google's siteverify endpoint, parsing the score, deciding a threshold, rejecting or accepting — is the part that turns a five-minute integration into an afternoon, especially on a static site with no server process to run that check from.

On a SimpleForm form, that step is a dashboard setting: enable reCAPTCHA v3 for the form, paste in the secret key from Google, and every submission's g-recaptcha-response field gets verified before the submission is accepted. Combined with the honeypot field (any field named starting with _, like _honeypot) and the IP rate limit of 10 submissions per endpoint per hour that run on every plan, a form ends up with three independent layers checking each submission before it reaches an inbox. The documentation covers the exact dashboard fields and the token field name for every spam-protection layer.

What if reCAPTCHA v3 Blocks a Real Visitor?

It won't block anyone outright — that's the point of a score instead of a wall. A low score just changes what happens next: reject outright, or fall back to a checkbox challenge for that one submission. The visitors most likely to land in the uncertain band are people on a VPN, corporate networks that route many users through one IP, or a browser with heavy privacy extensions that strip the signals reCAPTCHA reads. A threshold of 0.5 accepts the large majority of real traffic while still filtering out scripted submissions, and logging scores for a week before tightening the threshold tells you whether your own audience skews toward that uncertain band.

Before trusting the setup on a live form, submit a real test entry from your own connection and check the recorded score, then try the same form from a VPN or a browser with tracking protection turned up, since that's the traffic most likely to sit near the threshold. A form that only ever sees scores of 0.9 and above in testing is a sign the threshold has room to move down, not just up, without letting spam back in.

Add reCAPTCHA v3 to Your Next Form

Register a Google reCAPTCHA v3 key pair, add the script and hidden token field to your form's HTML, and if the form runs through SimpleForm, paste the secret key into that form's Pro or Agency dashboard settings — no server needed on your end either way. Create a free SimpleForm account and you can have the honeypot and rate limiting running on a form in minutes, then layer reCAPTCHA v3 on top once you're ready.

Frequently asked questions