reCAPTCHA on demand

  • performance
  • forms
  • spam

Updated

Overview

The Gravity Forms reCAPTCHA add-on protects forms with Google reCAPTCHA v3. It loads Google's script on every page of the site, with or without a form, and Google then downloads about 1 MB with every page view. That counts against the site's PageSpeed score.

Dirigible Optimize can hold Google's script back until it's needed:

  • It loads when a visitor scrolls near a form, or first taps, clicks, scrolls with the mouse wheel, moves the mouse or presses a key anywhere on the page.
  • A form near the top of the page loads it straight away, as before.
  • Sending a form always waits for Google's check first.

Off unless support turns it on

This one is off on every site until Dirigible support turns it on for that site. Here's why.

reCAPTCHA v3 has no "I'm not a robot" box. Instead, Google watches how the visitor uses the site and gives each form entry a score from 0 (likely a bot) to 1 (likely a person). The add-on compares that score with its Score Threshold (under Forms → Settings → reCAPTCHA, 0.5 unless someone changed it). An entry at or below the threshold is saved to the form's Spam list: the visitor still sees the normal confirmation, but no notification email is sent.

When Google's script loads later, Google sees less of the visit before the form is sent. That can lower the scores of real people, so more genuine entries could end up in Spam without anyone noticing. Support only turns it on after checking the site's recent entry scores, and checks them again afterwards.

There's nothing to set up yourself.

What stays the same

  • Every form is still checked on the server. An entry sent without Google's token (for example by a bot posting the form directly) is turned away exactly as it would be without Optimize.
  • The add-on's settings, Score Threshold and Spam list work as before. You can see an entry's score on its entry page.
  • If you've chosen to show the reCAPTCHA badge, it appears once Google's script has loaded rather than with the page.
  • reCAPTCHA Enterprise and checkbox keys keep loading as the add-on sets them up.
  • On forms that Turnstile protects, reCAPTCHA is switched off altogether (see One spam check per form). On demand loading applies to the other forms.

If a site uses it

Check the form's Spam list now and then. If real enquiries are landing there, tell Dirigible support: they can turn it off for the site, or you can lower the Score Threshold a little.

To rule Optimize out, deactivate Dirigible Optimize and purge the cache (see Troubleshooting).