Setting up Google reCAPTCHA

Where to find it: Left menu → Integrations → Security → Google reCAPTCHA Who it's for: Stores that want to use Google reCAPTCHA for bot verification, especially those already using Google Cloud. In short: You create a reCAPTCHA key at Google with your store's domains, enter the site key and the secret key (legacy secret key) into Treyza, and verify each domain once on your storefront. v3 is invisible; v2 shows the "I'm not a robot" box. It is free up to 10,000 verifications a month.

What does it do?

Google reCAPTCHA is Google's bot verification service. Today Google offers it under the name Google Cloud Fraud Defense, as part of Google Cloud; your keys live inside a Google Cloud project. On top of Treyza's built-in protection, it recognizes malicious traffic with what Google learns from millions of sites.

It comes in two versions: v3 gives every request a score without showing anything; v2 asks the customer to tick the "I'm not a robot" box.

If Google can't be reached, your free monthly verifications run out, or Google starts rejecting verifications, visitors are automatically verified with Treyza's built-in protection; your store doesn't lock up. Details: Bot protection: how your store is protected.

v3 or v2?

Know the order up front (this is where most people get stuck)

reCAPTCHA only works on domains you have registered with Google in advance, and the key type at Google must match the Sürüm (version) in Treyza. On top of that, Google doesn't report a wrong secret key as a separate error, so the secret key can't be tested from the server. That's why Treyza tests your keys once on a domain with Verify on storefront before using them there. On a domain that isn't verified, Treyza's built-in protection keeps running; a wrong setting can't lock your customers out of signing in.

The correct order:

1. List the domains your store opens on.
2. Decide between v3 and v2 (table above).
3. Create a key of the chosen type at Google with these domains.
4. Copy the site key and the secret key (legacy secret key).
5. Enter the keys into Treyza, enable the integration and save.
6. In the window that stays open, verify each domain with Verify on storefront.
7. Try signing in to your store in a private window.
8. Update your privacy notice.

---

1) List your store's domains

Write the domains without https:// and without a trailing /, path or port. Don't add treyza.shop itself; only add your own store's address.

---

2) Create a key at Google

There are two routes; both create the key inside a Google Cloud project. You don't need to enter billing details to create a key. This page writes button and field names as they appear in Google's own documentation, in English; if you use your Google account in another language, pick the equivalent in the same place.

Route A — reCAPTCHA admin console (shortest route)

Choose this route if you've never used Google Cloud. Google creates the needed project and settings for you.

1. Open google.com/recaptcha/admin/create and sign in with your Google account.
2. In the Label field, enter a name that reminds you of your store, for example "Modashop storefront".
3. Choose the type: Score based (v3) for v3, Challenge (v2) for v2. For v2, if extra options appear underneath, choose the one with the "I'm not a robot" checkbox.
4. Type the first domain from step 1 in the domain field and press the add (+) icon next to it; repeat for each domain.
5. If this is your first time using Google Cloud, read the terms of service and tick the checkbox.
6. Press the Submit button.

Route B — Google Cloud console

If you already use Google Cloud, you can create the key directly in the console.

1. In the Google Cloud console, open the Google Cloud Fraud Defense page: console.cloud.google.com/security/recaptcha. Check that the right project is selected in the project selector at the top of the page.
2. If the page asks you to enable an API (reCAPTCHA Enterprise API), press the Enable button.
3. Select the Keys tab and press the Create key button.
4. Enter a name in the Display name field.
5. For Application type, choose Web; the Domain list section opens.
6. Press Add a domain and enter the first domain in the Domain field; repeat for each domain.
7. Leave the Disable domain verification switch off.
8. For v3 you don't need to choose anything; a score-based key is the default. For v2, press the Next Step (optional) button and turn on the Will you use challenges? switch (you can leave the Challenge security choice at its default).
9. If the question Are you creating this key for testing purposes only? appears, leave it off; a test key doesn't evaluate real visitors.
10. Press the Create key button.

---

3) Copy the site key and the secret key

The Google Cloud console doesn't show the secret key by default; you get it from a separate window. Whichever route you used to create the key, both keys live in the Google Cloud console:

1. Open console.cloud.google.com/security/recaptcha and select the project that holds your key in the project selector.
2. Find your key on the Keys tab. The key's identifier (Key ID) is your site key; copy it.
3. Click your key to open the Key Details page.
4. On the Integration tab, press the Use Legacy Key button. If that button isn't there, press Integrate with a third-party service or plugin.
5. The window that opens shows the secret key (what Google calls the "legacy secret key"); copy it.

---

4) Enter the keys into Treyza

1. In the Treyza panel, open Integrations from the left menu.
2. In the Security section, click the Google reCAPTCHA card.
3. Fill in the fields in the window that opens. The field names currently appear in Turkish in the panel even in English; this table writes them as they appear on screen:

4. Press the Test Connection button and read the result (the message appears in Turkish):

5. Turn on the Enable Integration switch.
6. Press the Save button. The window stays open and the Domain verification list appears together with the text "Saved. Now verify your domains on the storefront."

Enabling first is safe: reCAPTCHA is used only on verified domains; on domains that aren't verified, Treyza's built-in protection keeps running.

An action you turn off (for example Formlarda kullan) stays protected by Treyza's built-in protection instead of reCAPTCHA; no action is left unprotected. Form file uploads are always verified with the built-in protection.

Minimum score (v3 only)

reCAPTCHA v3 gives every request a score between 0.0 (very likely a bot) and 1.0 (very likely a person). If the score is below the value you enter in En düşük puan (yalnız v3), Treyza doesn't reject the request: the visitor goes through an extra security check lasting a few seconds and carries on. That way a real customer with a low score can still get into your store.

The value must be between 0.1 and 0.9. Changing it doesn't reset the domain verifications.

---

5) Verify your domains on the storefront

The keys you saved don't take effect right away. In the window you see this description: "Keys take effect on a domain only after being verified once on your storefront; until then your customers are protected by Treyza's built-in protection."

1. Look at the Domain verification list in the window that stayed open after saving; it lists all of your store's domains. Next to the heading you see the provider's name and the integration's status (Active or Inactive). (The same list also appears on the Treyza Bot Protection card in the Integrations → Security section.) If the keys haven't been saved yet or the window has unsaved changes, you see "Save the keys first to verify your domains." instead of the list; press Save first.
2. Press the Verify on storefront button next to a domain. Your store's sign-in page on that domain opens in a new tab. You don't need to sign in.
3. With v2, tick the "I'm not a robot" box on the page (select the images if asked). With v3 you don't need to do anything. Within a few seconds a result banner appears on the page: "Bot protection is verified on this domain. You can go back to the panel and refresh."
4. Go back to the panel tab; the list in the window refreshes by itself. Repeat steps 2–3 for the other domains in the list.
5. When you're done, close the window with Close and refresh the page. The domains' statuses appear in the list on the Treyza Bot Protection card; the domains you verified show Verified.

Each domain in the list shows one of these statuses:

If no domain is verified yet, the list says "The keys haven't been verified on any domain yet." If the integration is Active, this note is shown as a warning; if it's Inactive, as an information note.

If verification fails, the banner says "Verification failed:" followed by the reason:

---

6) Check that it works

1. Open a private window in your browser (Ctrl + Shift + N in Chrome).
2. On a verified domain, open your store's sign-in page, for example https://modashop.treyza.shop/login.
3. What you should see:
   • v3: There is no verification box. Below the form, the line "This site is protected by reCAPTCHA." appears.
   • v2: The "I'm not a robot" box appears in the form. If you press the sign-in button without ticking it, the warning "Please tick the "I'm not a robot" box." appears.
4. Sign in with a customer account (with v2, tick the box first). The sign-in should succeed.
5. In the Treyza panel, on the Integrations → Security → Treyza Bot Protection card, the Verification method should be Google reCAPTCHA v3 (or Google reCAPTCHA v2) and the Passed count under Last 7 days should go up.

---

Troubleshooting

For errors during verification, first check the "Reason on the banner" table in step 5.

---

Cost and monthly limit

reCAPTCHA's free tier (Essentials) includes 10,000 verifications a month. The limit is the total for all projects and sites of your Google account (organization). Every sign-in, sign-up, password reset and form submission counts as one verification, failed attempts included. For example, a store with an average of 350 protected actions a day reaches the limit towards the end of the month.

On the Treyza Bot Protection card you see this store's monthly count: "{count} reCAPTCHA verifications this month (Google's free quota is 10,000 per organization per month)". When the number reaches 8,000, the line is shown in the warning color. This number only counts this store; Google's limit counts all sites in your organization together.

---

The badge and Google's notice

reCAPTCHA v3 normally places a fixed badge in the bottom-right corner of the page. Because that badge collides with the floating buttons in the bottom-right corner of the storefront, Treyza hides it and adds the one-line notice Google requires, "This site is protected by reCAPTCHA.", below the protected form itself. There's nothing you need to do.

---

Data protection (KVKK) and privacy notice

While reCAPTCHA runs, the visitor's IP address and technical information collected from their browser go to Google for risk analysis; Google may process this data abroad. reCAPTCHA also writes a cookie needed for risk analysis (_GRECAPTCHA) to the browser. Google states that it processes this information only to provide the service and keep it secure, and does not use it for other purposes such as personalized advertising.

Since April 2, 2026 Google processes this data on your behalf (as a data processor); you, as the store owner, are the data controller. Google no longer asks sites to link to its own Privacy Policy and Terms of Service; informing visitors is the job of your privacy notice. For suggested wording and a note on transfers abroad, see the Legal Pages (Agreements) page.

---

Frequently asked questions

I saved the keys, but my customers are still verified with the built-in protection. reCAPTCHA takes effect on a domain only when two conditions are both met: the domain has been verified with Verify on storefront, and the Enable Integration switch is on. Verify every domain marked Not verified in the Domain verification list and check that the integration is enabled (steps 4 and 5).

Why doesn't "Test Connection" test my secret key? Google doesn't report a wrong secret key as a separate error; its answer is the same as for a rejected verification. So the secret key can't be tested from the server. Test Connection only checks the format of the keys; the real test is done by Verify on storefront, with a fresh verification you perform on the storefront.

Can I use Google's test keys? No. Google's public v2 test keys let every visitor through, bots included; the protection would only be for show, so Treyza doesn't accept these keys. If you enter them, Save shows "Documented test keys can't be used on a live store; copy your real keys from the provider's dashboard." There is no test key for v3 anyway. Use your own key.

Do I need to enable billing to use reCAPTCHA? Not to create a key and use up to 10,000 verifications a month. If a store of yours goes over the monthly limit, Google recommends enabling billing so that reCAPTCHA protection lasts until the end of the month; if you don't, Treyza switches to the built-in protection for that month.

I have an old reCAPTCHA key. Can I use it? Yes. Google moved old keys into Google Cloud projects. Find your key's secret key through Integration → Use Legacy Key as in step 3, and make sure your store's domains are in the key's domain list.

I have several stores. Can I use the same key? You can (you add every store's domain to the same key's domain list and enter the same keys in each store). Still, we recommend a separate key per store. Remember that the 10,000 monthly verification limit is the total for all sites in your organization.

I connected a new custom domain. First add the new domain to the key's domain list (View key actions → Edit key → Update key), then press Verify on storefront for that domain in the Domain verification list in Treyza. Until you verify it, the built-in protection runs on that domain.

What happens if I turn reCAPTCHA off? When you turn off the Enable Integration switch and press Save, every action goes back to Treyza's built-in protection; you can close the window with Close. Your keys are not deleted.

What happens if I delete the key in Google Cloud? A deleted key can't be recovered, and no verification can be done with it. Before deleting the key, turn off the integration in Treyza, or enter a new key and verify your domains.

---

Related pages

• How bot protection works and the summary card: Bot protection: how your store is protected
• Setting up Cloudflare Turnstile: Setting up Cloudflare Turnstile
• Setting up and enabling integrations: Managing Integrations (List, Setup, Turning On/Off)
• Connecting a custom domain: Custom Domain
• Privacy notice and cookie policy: Legal Pages (Agreements)