WP Adverts reCAPTCHA - WordPress Plugin

A Guide to Setting Up WP Adverts reCAPTCHA to Protect Listings from Spam

WP Adverts reCAPTCHA is useful not as a decorative "I'm not a robot" checkbox, but as an extra barrier at the most vulnerable point on a classifieds site: where visitors submit a new listing or message a seller. This guide walks through the full process, from checking your WPAdverts setup and registering keys to choosing which users see the check, testing a submission, and troubleshooting a widget that fails to appear or accept a response.

This guide does not repeat the product’s short description. Instead, it focuses on the decisions site owners need to make: whether to allow guest submissions, whether to protect forms for logged-in users, how to tell a domain error from a theme conflict, and why CAPTCHA should not be your only line of defense. The goal is a predictable submission form where people can post listings and automated submissions do not slip through unnoticed.

WP Adverts reCAPTCHA works alongside the main WPAdverts plugin. It uses Google reCAPTCHA v2, so visitors may be asked to confirm that they are human. The add-on’s official documentation lists the settings page as Classifieds / Options / reCAPTCHA, with Site Key and Secret Key fields, as well as options for appearance and coverage. The sections below explain how these options fit into the actual listing process, rather than treating them as isolated settings.

This guide is for WordPress administrators who already have, or are planning to create, a classifieds site. If your site does not yet have a public submission form, first create and deliberately publish a page with the Classifieds / Publish block. Current WPAdverts documentation recommends using the block. The old [adverts_add] shortcode remains relevant on existing sites, but the developer marks it as deprecated.

Which risk the add-on addresses

Classifieds sites have a distinctive trait: their value depends on accepting content from users. The easier it is for visitors to go from browsing to posting, the more useful listings you are likely to get. But automated programs use that same path to submit links, repeated text, and meaningless entries. WP Adverts reCAPTCHA does not protect the entire site or WordPress login. It protects WPAdverts forms used to create listings or send contact messages.

Keep that distinction in mind from the start. If unwanted listings are appearing under Classifieds in the dashboard, begin by asking: Which public form is accepting the submissions? On older installations, it is often a page with [adverts_add]. In current block-based setups, it is a page with Classifieds / Publish. If visitors can also contact sellers, that may be a separate channel requiring the Contact Form module to be enabled and reCAPTCHA configured separately. Random registrations on wp-login.php are a different issue and do not prove that the add-on is malfunctioning.

WPAdverts’ official description names two practical goals: reducing automated listings and protecting owners and sellers from spam emails. So measure success by how the process changes, not by whether a checkbox looks good on the page. A bot should not be able to complete a submission without a valid reCAPTCHA response, while regular visitors should see the check only on the forms and for the user groups selected by the administrator.

Where the public listing flow begins

In a typical flow, a user opens the submission page, fills in the title, description, category, and other fields, uploads images if needed, then proceeds to preview and publish the listing. Historically, WPAdverts described this as a three-step process: form, preview, and publication. Some behavior now depends on the block settings, but the basic flow is the same: users enter data in the browser, submit it to the site, and the listing is created or prepared only after the server accepts it.

reCAPTCHA appears at the end of the relevant form. Keep this in mind when testing: do not expect it to appear next to the title or image upload button. Scroll to the bottom, fill in the required fields, and check whether the verification element appears before the publish action. When configured correctly, it is a natural part of the submission flow, not a separate page.

The contact form works in much the same way, but the value and risk are different. Here, automated submissions are meant to send unwanted messages to owners and sellers rather than create listing cards. If the corresponding module is enabled and contact forms are available on listing pages, adding a check there can reduce this channel. Do not enable the option just because it is available: first open a real listing in a private browser window and confirm that visitors actually use its contact form.

What the add-on does and does not promise

A visible check makes large-scale automation more difficult, but it does not guarantee that all bad content will be stopped. A real person can manually submit unwanted text, and some automated submissions may come through a route you have not protected. A more accurate description of the outcome is: WP Adverts reCAPTCHA adds a human check to the WPAdverts public flows you configure. That is a specific and useful job, but it does not replace moderation, submission rules, access controls, or monitoring the listings dashboard.

Do not expect the add-on to automatically protect WordPress registration, theme comments, a subscription form, or a form created with a third-party builder. Each of those channels needs its own supported protection method. Keeping these responsibilities separate helps avoid a false sense of security: if spam accounts appear, check WordPress registration settings; if advert entries appear in the dashboard, check the submission page and WPAdverts configuration; if sellers complain about emails, check the contact form.

For the same reason, do not rely on the add-on in place of backup processes. Have a way to temporarily restrict submissions, enable moderation, and quickly locate the public page. If the external verification service is temporarily unavailable, follow a plan you have already thought through: identify who is affected, disable only the setting in question if necessary, and keep the other filtering layers in place.

Who benefits from an open verification flow, and when to change the submission rules

WP Adverts reCAPTCHA is a good fit for sites where guests or registered users can post listings and the administrator wants to keep submission easy without creating an account for every visitor. Examples include a local services board, a neighborhood community, a member offers directory, a club marketplace, or a niche project with a modest number of listings. In these cases, the check adds a brief step to an existing form without changing the site’s overall setup.

It is especially useful if you have already seen a problem: repetitive drafts or published listings appear under Classifieds, descriptions contain repeated links, or the contact form receives identical messages. You do not have to wait for a large volume of spam. It is easier to set up protection and monitoring before an editor has to remove dozens of entries every day.

When a verification check makes sense

• Guest submissions. Visitors can post without logging in, so CAPTCHA provides a visible check before submission.
• Low-friction registration. Logged-in users can have a shorter path if that matches the add-on’s settings and your site’s policies.
• Seller contact. Listing pages include a contact form, and you want to reduce automated messages without removing a useful way to get in touch.
• A moderated classifieds site. The check adds protection but does not replace reviewing new entries before publication.
• Multiple submission forms. The site uses different form setups for different categories, so you first need to inventory each page to avoid leaving a public submission route unprotected.

The check is also easy for visitors to understand: they recognize the element and know why the site is asking them to confirm an action. That is better than a form that silently rejects the submission. At the same time, do not turn CAPTCHA into a penalty for regular contributors. If your site requires users to log in, it is clearer to ask visitors to sign in and explain why than to confront them with a lengthy form, strict moderation, and several unexplained barriers.

When the spam problem starts somewhere else

If only staff or members of a closed community should post listings, requiring a WordPress capability may be a better first step than adding CAPTCHA. In the old shortcode, the requires="read" parameter restricts submissions to logged-in users, while the Classifieds / Publish block has a required capability setting. This changes the access model, so it is a stronger restriction than simply adding a check: guests cannot use the form at all.

If every new listing needs editorial approval, enable moderation. It does not prevent an automated submission, but it keeps the listing out of public view until someone reviews it. That can be a useful safeguard for local sites where bad content poses a greater risk than an extra step for contributors. Manual moderation may not be practical on a high-volume site, in which case it is better to combine CAPTCHA, WPAdverts’ built-in filters, and selective review.

Sometimes the main symptom is fake account creation. Do not claim that WPAdverts reCAPTCHA will solve this without checking, because WordPress registration is outside the add-on’s configured flow. Open Settings / General, check whether registration needs to be enabled, and use a separate solution that is designed for the login and registration page. That way, you will not disable listing protection because of an unrelated problem.

Finally, this add-on is not the right choice for a site that does not use WPAdverts to accept user listings. If a third-party form builder handles submissions, entering keys under Classifieds will not automatically protect that form. You need an integration that explicitly supports it.

Why this add-on uses reCAPTCHA v2 and how that affects setup

The version question is about more than the number in the name. WPAdverts documentation explains that reCAPTCHA v3 serves a different purpose: it runs in the background and returns a score, after which the application has to decide what to do with that score. For listing submissions, the add-on developer chose reCAPTCHA v2: if the service has doubts, the visitor gets a challenge to complete. This approach fits a flow where the site needs to accept or reject a specific form instead of implementing its own risk scoring.

This leads to an important practical rule: your keys must match the type the add-on expects. Do not create keys for another reCAPTCHA version, paste them into the Site Key and Secret Key fields, and then try to fix the error by changing the theme or clearing the cache. First return to the Google console and check the key type and domain list. Then look for a WordPress-side conflict if needed.

A visible check as part of the user experience

For visitors, v2 means the form may show a checkbox or an additional challenge. Site owners should treat that as a deliberate trade-off for protection, not an interface defect. If anyone can submit listings and the site has already faced automated attacks, one extra step is usually more manageable than constantly cleaning up by hand.

This approach has a limitation, too. CAPTCHA can be an obstacle for some real people, especially with a dark theme, a narrow form column, or an unstable connection. The goal of setup is not to "show the check everywhere," but to make it readable, predictable, and available where it provides practical value. The light or dark theme, normal or compact size, and user groups selected all affect that experience.

Do not bury an explanation of the check in a long list of site rules. A short note beside the form can explain that verification helps protect listings and messages from automated submissions. Keep the wording neutral: visitors are not being asked to prove their good intentions to the administrator; they are completing a technical check before submitting the form.

The verification flow, from browser to site decision

It helps to think of the add-on as a five-step process. First, a visitor opens a WPAdverts form. The browser then loads the reCAPTCHA element and uses the site key to display it. After the visitor completes the check, the browser sends the response along with the form data. The server uses the secret key to verify the response with the provider. Only after successful verification can the listing or message submission continue.

The Site Key is not a secret; the browser needs it to display the check. The Secret Key must remain with the administrator and on the server. Do not put it in page text, screenshots, a public repository, or a message to someone posting a listing. When troubleshooting, it is usually enough to share the error type and confirm that the key was created for the right domain without revealing the key itself.

A reCAPTCHA response has a limited lifetime and can be used only once. This explains a familiar symptom: a visitor spends a long time filling in the form, returns to a completed check, clicks submit, and gets an error. You do not need to make them reload the entire site. Ask them to complete the check again and resubmit the form, if their data is still there. If this happens often, check the cache, dynamic loading, and user flow, not just the keys.

What to check before installing: a quick preparation without false confidence

Preparation saves more time than editing settings later. First, make sure WPAdverts is active and that the site has a real form you want to protect. Open it in a private browser window or log out. Administrators often see a different flow than regular visitors, so checking in your own session is not a substitute for testing as a guest.

Next, make a short inventory of submission points. Find pages with the Classifieds / Publish block, and on older pages search the content for [adverts_add]. If the project has multiple language versions, category landing pages, or separate forms for different listing types, add every URL to your test list. WPAdverts’ official spam prevention guide warns that a site may have several pages using the old shortcode. Protecting one does not make the others disappear.

Check whether you use Contact Form

The add-on’s Contact Form setting is useful only if the built-in contact form module is enabled and visitors send messages through listing pages. Look at a public listing. Is there a contact option available to guests? Does it open a form rather than just a mail link? If not, do not enable the option at random or treat the missing widget as evidence of a problem.

If the form is there, consider how important it is. On a classifieds site with a few infrequently posted listings, the contact channel may matter more than posting itself: one automated message goes straight to the seller. On a site where people communicate through a built-in messenger or an external platform, the contact form may be disabled. Your settings should reflect how the site actually works, not a generic checklist.

Domain, HTTPS, and separate environments

reCAPTCHA keys are tied to domains. Before creating a key, write down every real address where the form is available: the main domain, the version with www, any subdomain in use, and a separate testing address. Google documentation says that localhost must be explicitly added to the allowed domains for local development. For a live site, it is safer to use separate keys for testing and production so you do not broaden the production key’s scope unnecessarily.

Make sure the live site uses HTTPS and does not redirect visitors between different domains while they are filling out the form. CAPTCHA does not fix mixed content, certificate issues, or unstable redirects. If the main address has changed, first settle on the canonical public domain and update the list in the key console, then test the form again.

When it comes to caching, the answer is not to disable it, but to understand how it affects the page. A static copy of the page may include the widget container without issue, but aggressive optimization can sometimes delay or alter the loading of an external script. Before changing cache settings, run a basic test while logged out. If the widget disappears only after a specific optimization is enabled, record that observation and create an exception for the submission page or required resource instead of disabling caching across the site.

A basic rollback plan

Before installation, decide what to do if visitors can no longer submit listings after you enable the add-on. You do not need text-file copies of the secret keys; you need a safe administrative path: access to WordPress, a clear idea of where Plugins is, the settings page address, and a way to temporarily remove the form from the add-on’s coverage. Record the original state: whether moderation was enabled, whether guests could submit, and whether the contact form worked. This will help you undo only the new change instead of accidentally opening submissions to everyone without rules.

Before installing: You should be able to name one specific public page, one user type to test, and the outcome you expect. "The site should have CAPTCHA" is too vague for reliable troubleshooting.

Installing the add-on and reaching the first checkpoint

WP Adverts reCAPTCHA extends the main WPAdverts plugin; it does not replace it. The order matters: activate and configure the base plugin first, then upload the add-on archive, and return to the WPAdverts dashboard. The official module installation instructions describe the standard WordPress steps: Plugins / Add New / Upload Plugin, select the ZIP archive, install it, and activate it. After activation, the add-on appears under Classifieds / Options, where its settings should be available instead of a prompt to get the add-on.

1. Under an account that can install plugins, open Plugins / Add New / Upload Plugin.
2. Select the WP Adverts reCAPTCHA ZIP archive you received, install it, and click Activate Plugin.
3. Go to Classifieds / Options and confirm that the reCAPTCHA tab or panel is available.
4. Do not enter random keys or enable form coverage until you have created a compatible key pair in the Google console.
5. After filling in the settings for the first time, save them and reopen the page to confirm that the values were accepted.

The first checkpoint is not just a new menu item. Both of these should be true: the add-on is active in WordPress, and Classifieds / Options / reCAPTCHA opens without errors. If the tab is missing, do not start by clearing the cache or editing plugin files. First confirm that the add-on archive itself is activated, that WPAdverts is active, and that WordPress has not reported a compatibility issue or fatal error.

Keep installation separate from the listing test

After activation, do not immediately publish a real listing on behalf of a customer. Set up a safe test: use a separate test category or a clear internal title that you can easily remove later. The point of the test is to check the full flow, including whether the verification appears, the form can be completed, and the listing gets the expected status, not to fill the site with random content.

If you have a staging site, test the add-on there first. Use a key allowed for its domain. Do not copy your production key pair to an unprotected demo site. After the test passes, repeat the main steps on the production domain with its own configuration. This is not busywork: many CAPTCHA problems come from differences between domains and environments.

What to avoid during installation

Do not modify WordPress core, WPAdverts files, or the add-on’s source code just to make the widget appear sooner. Such changes complicate updates and will not fix a key or domain error. Do not install several anti-spam plugins on the same form at once without a plan; visitors could end up facing two separate barriers, and you may not know which one caused an error.

Do not copy keys from another site, a public example, or an old guide. Each pair has its own domain restrictions and purpose. If you have lost access to the console, the sensible path is to restore access to the account or issue a new pair and replace both keys at the same time, rather than guessing from an old field.

Keys and the reCAPTCHA panel: settings that affect the form

After installation, go to Classifieds / Options / reCAPTCHA. The WPAdverts help guide lists six groups of settings: Site Key, Secret Key, Theme, Type, Size, and separate user coverage settings for Adverts Add ([adverts_add]) and Contact Form. The panel is simple, but it is best to understand what each option does before saving.

Create a key pair with the right type

In the reCAPTCHA console, create a key for the required web domain and a version compatible with visible v2 verification. Give it a clear internal label, such as the project name and environment. Add the domain to the domain list without a page path. The path /publish-an-ad/ is not a separate domain and does not replace the main address.

After registration, you will receive a public site key and a secret key. Copy the Site Key into the matching WPAdverts field and check that you have not included an extra space at the beginning or end. Then enter the Secret Key in its protected field. Do not put the secret in article notes, a screenshot, or a screen recording. If another administrator needs access, share it through a secure password management channel, not through a listing form or a group chat.

Save the changes with Save Changes, if that button is present in your version of the panel. Then reload the settings page. If the keys do not save, first check your user permissions and look for a save error in the interface. Do not enter the keys dozens of times; one careful entry followed by a check is more reliable than repeated guesses.

Theme: a light or dark widget

The Theme setting offers Light and Dark. Official documentation recommends the light theme by default and the dark theme only for forms on dark backgrounds. This is not just a matter of brand style. A dark widget inside a white form card may look jarring, while a light widget on a dark theme may be hard to read.

Open the public form, not just the settings panel, and check the widget’s edges, the container background, and the spacing before the submit button. On sites with a light and dark theme toggle, test both interface modes. If the form changes color but the add-on has only one theme setting, prioritize readability in the main user flow or adjust the form design through your theme without changing CAPTCHA behavior.

Type and Size: when saving space causes problems

The add-on documentation lists Image and Audio for Type and recommends Image. Keep the recommended type unless you have a specific reason and have tested the alternative. This setting is about how visitors complete verification, not about improving speed or SEO.

The Size setting offers Normal and Compact. The normal size suits a wide, single-column form and is generally easier to use. The compact option may be needed in a narrow container, but do not enable it "just in case." After choosing a size, open the form at a typical browser width. Check that the widget stays within its container, does not overlap the button, and can be completed without horizontal scrolling.

Responsive behavior depends on more than the CAPTCHA size. Long labels, extra fields, sidebars, and theme styles can make the form narrower than it looks in the editor. That is why you should check the published page in a regular visitor’s browser. If the widget does not fit, first check the container width and form styles, then consider Compact.

Who should see the check on the submission form

The Adverts Add ([adverts_add]) setting controls which users see the check on new listing forms. Its name reflects its historical connection to the shortcode, but in practice it applies to the WPAdverts submission feature. Before choosing an option, answer two questions: Can anonymous visitors create listings, and should logged-in users go through the same check?

For a public classifieds site, covering guests is usually a sensible starting point. The owner protects the most open entry point, and regular users do not face an extra hurdle after logging in. But this is not a universal rule. If registration is easy and accounts can be created in bulk, being logged in does not necessarily mean the user is trusted. In that case, you may want to cover a broader group or add moderation and account rules.

If your panel uses different labels, do not guess what an option means from its name. After saving, run two tests: one in a guest window and one with a regular test account. Record the outcome in plain language: "Guests see the check; test users do not" or "Both groups see the check." That note makes it easier to spot changes after an update, theme switch, or site migration.

Separate coverage for Contact Form

The Contact Form setting is independent of listing submission. Enable it if the contact form module is active and you want to protect message submissions. Check who can use the form: guests, logged-in users, or everyone. As with listing submission, protecting guests only may be a sensible starting point, but the final choice depends on how well registrations are managed and how costly missed spam would be.

After saving, do not stop at viewing a listing as an administrator. Find a published test listing, open it in a private window, and bring up the contact form. According to the official documentation, the widget should appear at the end of the form. If you see a message field and button but no check, first confirm that the contact module is enabled and the right audience is covered. Then check the keys and cache.

Critical expected state: The keys are saved in the dashboard, and the widget appears in the public form for the user type you selected before any data is submitted. Either sign alone is not enough.

Submission forms, blocks, and the deprecated shortcode: where protection appears

This is one of the most product-specific details of WPAdverts. The add-on does not create a new form or choose a page for you. It connects to an existing submission flow. So first identify how the page was built and what rules apply to it.

In current WPAdverts, use the Classifieds / Publish block. The documentation says that activating the plugin creates a page with this block as a draft so submissions are not opened by accident. In the page editor, add the block, select the Classifieds post type, choose a form scheme if needed, and apply the settings. Publish the page only after testing it. This order is useful in itself: security starts with making sure a form does not go public before you understand how it behaves.

Block settings that change the risk

The submission block has several settings that work alongside CAPTCHA. Moderate Ads sends new listings for review instead of publishing them right away. Skip Preview shortens the flow by removing the preview step. Capability required to publish requires a specific WordPress capability, such as read for logged-in users. Error Message displays a clear message if a visitor does not have the required capability.

Each setting addresses a different concern. CAPTCHA checks whether an action looks human. Moderation determines who can make a listing public. A required capability determines who can start the submission flow at all. Preview affects usability and when users notice mistakes in their data. Do not use one setting as a substitute for another. For example, enabling moderation does not stop bots from filling the queue, and disabling guest submissions does not make every registered account safe.

For a small private site, a workable combination may be a login requirement, moderation for first-time listings, and CAPTCHA for selected user groups. For an open classifieds site, guest access, CAPTCHA, built-in WPAdverts filters, and selective moderation may matter more. Choose a setup your editors can actually maintain, not simply the strictest one.

What to do with an existing [adverts_add] shortcode

There is no need to remove the shortcode in a panic on an older, working site. It may still serve the submission form, and the add-on’s official documentation uses it in the name of a setting. However, the WPAdverts developer marks [adverts_add] as deprecated and recommends the Classifieds / Publish block for new and updated pages. That means you should plan to move the form during a scheduled refresh rather than build new features around a deprecated flow.

The shortcode is also useful for troubleshooting. The old moderate="1" parameter enables moderation, while requires="read" restricts the form to logged-in users. If you find several pages with different parameters, do not draw conclusions from just one. Open each page, check whether guests can access it, and decide whether it is still needed. A duplicate test page with active submissions can be a source of spam even when the main page is protected correctly.

[adverts_add moderate="1"]

This example from the official documentation is useful only for an existing page on an older site. Consider the consequences before applying it: all new listings will wait for review. After changing the setting, submit a test listing and confirm that it gets the expected status. If that does not fit your project’s workflow, remove the parameter or restore the previous page version. Do not edit the add-on files to make this change.

Use the listing management page to verify the outcome

The flow does not end when a visitor clicks Publish. WPAdverts provides the Classifieds / Manage block and, on older sites, the [adverts_manage] shortcode, where authors can view, edit, and delete their listings. After a test submission, this is a useful place to check: the author should see the listing they submitted, without duplicates, and the administrator should see the expected status in the dashboard.

If moderation is enabled, do not treat a listing missing from the public directory as an error. Check whether it is marked as pending review and whether the administrator can see it. If moderation is disabled, compare the title, description, and category on the public listing with the test submission. This helps distinguish a CAPTCHA issue from submission rules, post status, and directory filters.

Practical example: an open local classifieds site with controlled submissions

Consider a specific use case. A local community website lets residents post services and secondhand items. The administrator wants to allow submissions without requiring an account because that lowers the barrier to posting. At the same time, automated entries with links have started appearing, and the editor does not want to delete dozens of junk listings by hand. The solution should not promise to eliminate every bad submission. The goal is to reduce automated posts, keep the process clear for people, and have another layer of control.

The goal and starting conditions

The goal is for a guest to open the submission page, fill in the form, complete reCAPTCHA, and submit a listing. If the project uses moderation, the listing should not go public until the administrator approves it. Depending on the CAPTCHA coverage setting, a regular registered member will either follow the same flow or a shorter one. Protect the contact form separately if it is enabled on listing pages.

Before you begin, make sure four conditions are met: WPAdverts is active, there is a published or prepared test page with Classifieds / Publish, WP Adverts reCAPTCHA is activated, and a key pair has been created for the live domain. Also create a regular test account without administrative privileges. Do not test only as an administrator: administrators may bypass some restrictions, so they do not represent the visitor experience.

Step 1: Set up the submission page as a managed flow

Open the page in the editor and select the Classifieds / Publish block. Confirm that the Classifieds type is selected. If you use different field schemes for different categories, do not enable them just to experiment. Use a scheme that already works or leave the default in place. The priority is to protect one clear, stable route first.

Enable Moderate Ads if an editor is ready to review new entries. This adds a second control: even if an unwanted submission bypasses the human check or comes through another route, it will not automatically appear in the directory. Leave Skip Preview disabled for the first test. Preview helps users spot errors and shows whether the data is preserved before publication.

Guest submissions remain allowed, so leave Capability required to publish empty. If your policy changes and only members should be able to post, set the appropriate capability and prepare a clear message. Do not make it a hidden switch: visitors should understand that they need to log in rather than assume the form is broken.

Step 2: Enable WP Adverts reCAPTCHA for the right users

Enter the key pair under Classifieds / Options / reCAPTCHA. Choose Light if the form is on a light background. Keep Image and Normal unless you have a specific reason to change them. For the new listing form, choose an option that covers guests. If the panel offers broader coverage, do not extend it to all users without first deciding how to handle regular contributors.

In this example, enable the contact form check only after inspecting an actual listing. If sellers really receive messages through the built-in module, configure the check for guests there, too. If messages go through a phone number, messaging app, or external form, leave this option disabled. Protection should not create the false impression that another channel is already covered.

Save the settings. Do not clear the cache automatically after every click. First open the guest submission page. If nothing changes, use the troubleshooting sequence below: check the selected audience, keys, and domain, and only then investigate a cache exception.

Step 3: Run two different test submissions

Run the first test in a private browser window. Open the submission page as a guest and fill in a safe test listing with a unique title, such as "Form verification test - do not publish." Do not include real phone numbers, addresses, or links. Scroll to the bottom, complete reCAPTCHA, and continue. If there is a preview page, confirm that the title and description are still there. Then submit the form.

Run the second test with a regular test account. This checks whether the selected audience rule works as intended. If only guests should see the check, confirm that the logged-in user does not see it and can still submit the form. If the check is enabled for everyone, confirm that it appears and the submission succeeds. Do not treat the difference as a bug if it matches your chosen rule.

For both tests, check more than CAPTCHA. Make sure a double-click does not create two listings, that error messages are clear, and that the status matches your moderation settings. Find the test listing in the administrator dashboard and compare its author, time, and content. Then delete the test entries or leave them in a private test category if the team needs a permanent reference.

Step 4: Check the public and administrative outcomes

If Moderate Ads is enabled, the expected public outcome is that the listing stays out of the directory until approved. The expected administrative outcome is that the entry is available for review in the dashboard. After manually approving it, reopen the directory in a guest window and confirm that exactly one listing appears. If moderation is disabled, the listing should appear according to WPAdverts’ rules without an approval step.

For the contact form, send one neutral test message using the test listing. Check three things: the widget appears for the intended users, the email or other expected action happens after successful verification, and the form does not quietly send a message without a completed check. Do not test this on a real seller without coordinating with them.

Quick recap: WP Adverts reCAPTCHA is configured only after you test both user roles and check the listing status, not just after saving the keys. That turns setup from guesswork into a repeatable workflow.

How to verify the setup without mistaking appearance for functionality

A widget on the page proves only that the client-side element loaded. To confirm that the whole flow works, the server must accept and verify the response, and WPAdverts must continue along the expected path. Check three things: display, form behavior, and the resulting data.

Level 1: The check appears for the right visitor

Open the form in a private window. Scroll to the bottom and make sure the widget is not outside the visible area, below the button, or inside a container with zero height. Check it at a normal browser width and in a narrower window. This is not about design preference; it is about whether visitors can complete the check without clipped text, horizontal scrolling, or overlap with a field.

Compare the result with a test account. If the two groups should see different things, the difference should match your plan. If both tests look the same, that is not always a problem, but it is a reason to revisit the selected setting and the documentation for your add-on version.

Level 2: Behavior with a completed and incomplete check

Fill in the minimum required fields. First, leave the check incomplete and try to submit the form. The expected behavior is a clear barrier to submission, not a listing that appears without notice. Then complete the check and submit the same test form. It should proceed to preview or publication according to the block settings.

Do not use this test to generate artificial traffic to the service. Two controlled attempts are enough. If the form clears all the data after the first rejection, record that as a user experience issue, but do not use it as a reason to disable protection. Consider saving a draft, shortening the form, or adding a clearer message beside the check if your theme and WPAdverts setup allow it.

Level 3: The WPAdverts record

Open Classifieds in the dashboard and find the test entry by its unique title. Compare its status with the moderation setting. Then open the public directory or the listing management page. With moderation enabled, confirm that the listing stays hidden until approval and appears afterward. Without moderation, confirm that it appears under the correct test author.

If the contact form is enabled, check the recipient and email in a controlled test. CAPTCHA does not fix email delivery. If the check passes but the message does not arrive, that is a separate SMTP, mail policy, or contact module issue. Separating symptoms prevents an unnecessary add-on reinstall.

A good outcome: A user in the selected group can complete one clear check, and the listing or message leaves the expected record in WPAdverts. A checkbox without a successful test submission is not a final check.

Layered protection: use reCAPTCHA with honeypot, timetrap, and access rules

WPAdverts’ official article on unwanted listings recommends combining several methods. That is more practical than looking for a single setting that supposedly stops everything. The core WPAdverts plugin includes honeypot and timetrap mechanisms, as well as settings for limiting links and blocking phrases. The reCAPTCHA add-on adds another layer; it does not replace the others.

What each layer does

A honeypot adds a hidden field that a regular person will not fill in, but a basic bot may populate when it reads the markup. A timetrap checks for submissions that happen too quickly: WPAdverts documentation describes a hidden field with an encrypted timestamp and rejection of implausibly fast submissions. Link limits and a list of blocked phrases let you tailor the filter to the typical content on your site. reCAPTCHA adds an interactive human check to selected forms.

These mechanisms overlap, but they do not completely duplicate one another. Honeypot and timetrap are especially useful against simple automated submissions. A blocked phrase list depends on your niche and needs care, because legitimate users may also use a matching word. CAPTCHA adds a barrier at the point of submission. Moderation controls whether the listing becomes public. Access restrictions determine who can start the process.

Start with the defaults where WPAdverts enables them, and make changes only in response to an observed problem. For example, if spam nearly always contains many links, it makes sense to check the link limit. If legitimate users often link to their own pages, a strict limit could cause false rejections. Do not copy someone else’s blocked word list without reviewing it; it could filter product names, city names, or terms specific to your field.

Compatibility with caching, themes, and the editor

The submission page is a dynamic part of the site, so test it after enabling optimization features. If a cache plugin combines or delays third-party scripts and the widget disappears, identify the smallest exception needed: a specific submission page, handler, or external resource that is documented as requiring normal loading. Do not disable all optimization across the project because of one symptom.

The theme affects contrast, width, and spacing. It should not change the key type or server-side verification. If CAPTCHA is present in the markup but invisible, first use the browser’s developer tools to find the CSS hiding its container. Then fix the style in a child theme or a safe custom styles area. Do not edit WPAdverts core styles; an update would overwrite the change.

The block editor affects where the form appears. After editing the page, always check the published version as a guest. The editor preview may not reproduce the widget’s dynamic behavior, caching, or access rules. If the editor adds a sidebar or template area, check how much width is available to the form and use the compact size only after testing it on the actual page.

Accessibility, privacy, and setting clear expectations

reCAPTCHA connects to an external service, so your site may have disclosure obligations depending on your jurisdiction and privacy policy. Do not claim in your policy that no data is transmitted if the page loads a third-party verification service. Instead, describe its purpose accurately: the site uses the check to protect forms from automated submissions and refers users to the provider’s current documentation and its own policy.

The availability of an Audio option does not mean the entire form is accessible. Labels, errors, keyboard focus, and the submit button should remain clear. When real users report a problem, do not immediately disable protection for everyone. First record the browser, page, user role, and exact point where the issue occurs. The cause may be the theme, container width, a script blocker, or an expired key.

Choose a submission model: three ways CAPTCHA fits into the flow

The same technical setting can shape the user experience in different ways depending on your site’s submission rules. It helps to choose a publishing model first, then decide which users should see reCAPTCHA. There is no single "best" mode for every site in this section. Instead, there are three clear options, each balancing posting speed, editorial workload, and the risk of unwanted listings differently.

Open guest submissions with a human check

In the first model, a guest opens the page, fills in the form, completes CAPTCHA, and submits a listing. If moderation is disabled, the entry becomes available according to WPAdverts rules. This is the shortest path for contributors and puts the most responsibility on the other protection layers. It makes sense when posting speed matters, such as for urgent service listings, quick local offers, or a directory where an editor cannot review every entry by hand.

In this model, CAPTCHA belongs where guests can create content. But it does not replace checking the quality of published listings. Use sensible built-in WPAdverts anti-spam measures, watch for unusual increases in submissions, and have a way to restrict posting temporarily. Do not judge the setup after the first week alone: keep a simple record of how many unwanted entries reached the dashboard, which page they came from, and when. This helps distinguish an isolated event from an ongoing attempt to bypass the rules.

Verification is especially important in this model. A test guest should see CAPTCHA, complete it, and create exactly one entry. Then check the public directory. A listing should appear immediately only if moderation is disabled. If it does not appear, check its status in the dashboard instead of changing the keys. If it appears twice, investigate duplicate submissions and how the theme handles the button; CAPTCHA does not prevent the form itself from submitting twice.

Guest submissions with moderation

In the second model, guests complete CAPTCHA, but each new listing waits for review. This works well for small communities, service directories, pet listings, rentals, or local offers where content quality and trust matter. reCAPTCHA reduces automated submissions, while moderation catches entries that pass the technical check but do not meet the site’s rules.

This model comes with a cost: an editor must check the queue regularly. If they open the dashboard only once a week, good listings will wait too long, and users may assume the form did not work. Before enabling moderation, assign someone to review entries, set a reasonable response time, and prepare a status message for the page. Do not promise immediate publication if that is not how the site works.

Verify this flow with two separate checks. First, guests cannot complete the form without passing verification. Second, after a successful submission, the entry appears in the administrative queue and remains hidden from visitors until an editor acts on it. After approval, it should appear once. If it is visible sooner, the block setting may not be enabled, you may be checking a different page, or the test may be using a special user role.

Submissions for logged-in members only

In the third model, the form requires a WordPress capability. The Classifieds / Publish block uses Capability required to publish for this; older shortcodes used the requires parameter. For example, a logged-in user usually has the read capability. This model changes the risk substantially: a random guest can no longer start a submission, but you take on the work of managing registrations, account recovery, and possibly checking new accounts.

CAPTCHA is not necessarily redundant in this model. If users can register without verification or accounts are frequently created automatically, logging in alone does not mean someone is trustworthy. On the other hand, if staff or members of a private community receive access manually, asking every regular contributor to complete CAPTCHA may be unnecessary. Base the decision on how you grant access, not on the fact that the section is private.

Check the flow with three user types: a guest should see a clear message that they need to log in, a regular member should see the form and complete it according to the CAPTCHA coverage setting, and an administrator should receive the expected entry without bypassing the rules. If a guest can still submit a listing, do not look for a reCAPTCHA issue first. Check whether the capability setting was saved and applied to the right block.

Choose a model without guesswork

Make a short decision table in your working documentation, not in the interface. The first column should say who can post: anyone, guests after verification, registered users only, or members approved manually. The second should say whether an editor needs to approve every entry. The third should say where CAPTCHA is enabled. The fourth should name the person responsible for checking the queue and spam each week. Even a simple map prevents a common mismatch: a developer thinks the form is open, an editor expects moderation, and a visitor encounters an unexpected restriction.

After choosing a model, do not change every rule on the live site at once. Create a test page, apply the new setup, run a controlled submission, and only then move the changes to the main form. If needed, keep the old form closed or available only at a test address, but do not leave two public forms with different rules unless there is a clear reason.

After launch: catch problems before users report them

Protection setup does not end on installation day. Forms change along with themes, blocks, caching, domains, and access policies. A simple monitoring plan helps you catch the effects of an update before listing authors start contacting support. You do not need a special security log: regularly check a few things and follow a clear set of steps.

A quick weekly check

Once a week, or at another interval that suits the project, open the submission page in a private window. You do not need to submit multiple test listings every time. Confirm that the form opens, the widget appears for the expected user role, and the page does not show an obvious error. Then review new listings and messages for repeated templates, links, identical titles, or suspicious spikes.

On a moderated site, also check how long entries have been waiting for review. A long queue may point to an organizational issue rather than an attack. A user who does not realize their listing is pending may submit it again. Editors then see duplicates and mistake them for bot activity. A clear status message and timely review reduce this noise more effectively than tightening CAPTCHA.

Check again after updates

After updating WordPress, WPAdverts, the add-on, your theme, or a caching plugin, run the same basic test. There is no need to assume that every update is dangerous, but listing submission is a critical flow and deserves a quick check. Start by confirming that the widget appears, then submit one test listing and check its status. If the test passes, record the date, environment, and outcome in your administrative log.

If the test fails, first identify which part changed. For a domain or key error, check the reCAPTCHA console. If the widget container disappears, check coverage, the page, and caching. If the listing has an unexpected status, check the block settings. If the issue occurs only in one browser, try to reproduce it in another. This order helps prevent the risky habit of disabling protection as the first response.

Changing the domain, subdomain, or site address

A site migration can quietly break CAPTCHA: the site opens and the form appears, but the key still belongs to the old domain. Add updating the allowed domains or issuing a new key pair, entering it under Classifieds / Options / reCAPTCHA, and running a guest test to your migration plan. Do this before opening the new address to search engines and users.

Pay the same attention to subdomains. If the form moves to a separate address, check the provider’s domain validation rules. Do not disable domain verification just to make the form work temporarily; that changes the security of the key. Instead, allow only the domains you need and test the form again.

Treat keys as secrets, not appearance settings

Manage the key pair as carefully as other integration credentials. Restrict access to the WordPress dashboard and provider console. Do not share the secret in a support ticket, screenshot, or page backup. If you suspect that the secret has been exposed, issue a new pair, replace both fields, test them, and revoke the old pair using the provider’s process.

Do not add the secret key to custom CSS or PHP snippets. WPAdverts already provides fields for it. Hard-coding it into a theme will not strengthen verification; it will create a disclosure risk and make updates harder. The safer improvement here is a process, not code: separate keys for different environments, limited access, a controlled rotation, and a documented test afterward.

What to include in a support request

If the problem persists, a useful support ticket includes the test page URL, user role, exact error text, time of the test, the environment where it occurred, and steps to reproduce it. Do not include the secret key. Say whether the widget appears, whether it passes, whether a listing is created, and what status it gets. These four observations tell support much more than "CAPTCHA is broken."

It can also help to say whether the error occurs in a private window and with the optimizer temporarily disabled on that specific page. Do not leave the site with optimization disabled longer than needed to reproduce the problem. The goal is to gather enough evidence to confirm a conflict, then add a precise exception or contact the provider.

Troubleshooting: the widget is missing, rejects responses, or fails to stop spam

Start troubleshooting with the symptom, not a reinstall. The steps below help preserve working settings while you distinguish between a domain, key, form coverage, cache, contact module, or WPAdverts rules issue. Make one change at a time, then repeat a controlled test in a private window. Do not change the theme, keys, and audience settings all at once; afterward, you will not know which change affected the outcome.

The widget does not appear on the guest form at all

Symptom: A guest opens the submission page, fills in all the fields, but does not see reCAPTCHA.

Likely causes: The add-on is inactive; the keys were not saved; the Adverts Add ([adverts_add]) setting does not cover this user type; the wrong form page is open; a cache plugin or script optimization is changing how the widget loads; or the theme styles are hiding it.

What to check: Start with Plugins, then open Classifieds / Options / reCAPTCHA and confirm that the values were saved. Next, compare the test URL with your list of public pages. If the site uses a block, make sure the right page is published. Then test in a private window without browser extensions that might block external resources.

How to fix it: Enable coverage for guests, save the settings, and test again. If the widget appears only when optimization is disabled, confirm the cause and add a minimal exception for that specific flow. If the widget is in the markup but not visible, adjust the form style in a child theme or custom styles area.

When to roll back: If changing optimization breaks other critical pages, restore the previous rule and gather more precise evidence. Do not leave caching disabled across the site as a permanent troubleshooting measure.

An error message mentions the key or domain

Symptom: The widget reports a key error, fails to load at a specific address, or works on the test site but not on the main site.

Likely causes: A key for the wrong type was created; the Site Key and Secret Key are from different pairs; the current domain is not allowed in the console; the site redirects between addresses; or an extra character was entered in a field.

What to check: In the provider console, confirm that the key type matches the v2 check in use and review the domain list. Check the actual address in the browser’s address bar, not just the site name you expected. Return to WPAdverts and make sure both values from the same pair were entered without spaces.

How to fix it: Add the exact domain to the allowed list or create a valid pair for the right environment. Replace both values in WPAdverts and save. For local development, use a separate key with localhost explicitly allowed instead of using the production key.

When to roll back: Do not disable domain verification just to make the error disappear. Google warns that doing so increases the risk of the key being used on other sites. Correct the domain list and test again instead.

The check passes, but the form reports an error or does not publish the listing

Symptom: The user completes CAPTCHA, but after submission stays on the form, sees a verification error, or does not get the expected status.

Likely causes: The response expired while the user was filling out the form; they tried to reuse a response that had already been submitted; a required WPAdverts field is invalid; the submission block requires a capability or moderation; or dynamic form loading is causing a conflict.

What to check: Reload the page and repeat the test, completing verification just before submitting. Read the form’s message in full and check the required fields. Then review Moderate Ads, Capability required to publish, and the expected status in the dashboard.

How to fix it: Tell users to complete the check again if they have spent a long time filling out the form. Correct the specific required field or access rule. If the problem occurs only after AJAX optimization or the form is recreated, disable that feature on the submission page and test again.

When to roll back: If an experimental block setting changes access for everyone, restore the previous block configuration. Do not disable CAPTCHA until you have confirmed that it is the cause.

The widget appears, but spam still reaches the dashboard

Symptom: CAPTCHA is visible on the main page, but unwanted listings or messages continue to appear.

Likely causes: Spam is coming through another form page; the attack is targeting registration or another plugin; senders are passing the check as real users; CAPTCHA covers only guests while the problem accounts are already logged in; or moderation is disabled, making content public immediately.

What to check: Find an entry by its time and work out which flow may have created it. Check all pages with the submission block and the old [adverts_add] shortcode. Separate listings, contact messages, and registrations. Review whether honeypot, timetrap, link limits, and suitable status rules are enabled.

How to fix it: Close unnecessary pages, broaden CAPTCHA coverage if your policy supports it, and add moderation for sensitive categories. Enable or adjust WPAdverts’ built-in protections based on the content you have observed. Use a separate WordPress protection method for registrations.

When to roll back: If a new rule blocks regular contributors by mistake, first narrow its scope or adjust moderation instead of disabling every protection layer at once.

The problem occurs only in dark mode or on a narrow screen

Symptom: The form works on a wide, light page, but the widget is hard to see, clipped, or overlaps the button in another interface mode.

Likely causes: The Theme setting is not a good fit; the container is too narrow; theme CSS overrides iframe dimensions or spacing; or the compact version has not been tested in the actual template.

What to check: Compare the container width and background in both modes. Check whether the theme applies general styles to iframe elements. Test the form in a medium-width browser window instead of relying on the editor preview.

How to fix it: Choose a widget theme with sufficient contrast against the main background and adjust the container width with a safe child theme style. Consider Compact only if the normal size genuinely does not fit.

When to roll back: If a new CSS rule affects every iframe on the site, remove it and scope the selector to the WPAdverts form. Do not override styles across WordPress to fix one widget.

Common questions about protecting listing forms

Do I need WP Adverts reCAPTCHA if honeypot and timetrap are enabled?

These methods address different parts of the problem. Honeypot and timetrap help filter out simple automation without adding a step for visitors, while reCAPTCHA adds a human check to a selected form. WPAdverts’ official article on spam recommends combining methods. Start with the built-in layers, add CAPTCHA to the open submission flow, and check the outcome with real tests.

Why does the add-on developer not offer reCAPTCHA v3?

WPAdverts documentation says v3 returns a score, and the application must decide what to do with it. For registration and listing submissions, the developer considers the v2 approach a better fit because users complete a challenge when needed. So for WP Adverts reCAPTCHA, create keys for the expected v2 version rather than trying to use keys for a different mode.

Can I show the check only to guests?

The add-on lets you choose when and to whom CAPTCHA appears for listing submissions, and separately for the contact form. The exact options depend on the installed version and interface, so verify your choice with two tests: one as a guest and one with a regular account. Showing the check only to guests is often convenient, but if registration is poorly controlled, you may need broader coverage.

Will the add-on protect WordPress registration?

There is no reason to assume it will do so automatically. WP Adverts reCAPTCHA applies to the WPAdverts forms listed in its settings. If you are dealing with unwanted accounts on wp-login.php, first check whether open registration is necessary and use a separate solution designed for that flow.

What if the widget appears, but the listing stays under review?

First check the Classifieds / Publish block settings or the old shortcode. If moderation is enabled, that status is expected and does not indicate a CAPTCHA error. Find the entry in the dashboard, approve the test listing, and confirm that it appears in the public directory only afterward.

Should I enable protection for Contact Form?

Enable it if the built-in contact form module is active and visitors really do send messages through listing pages. Then check a specific listing in a guest window. If the site uses another contact channel, the WPAdverts setting will not protect it automatically.

Why is the widget missing only for me?

Start with a private window and another browser. An extension, content blocker, active administrator session, or cache may change what you see. Then check the audience setting, page URL, and key domain. A successful test as an administrator does not prove the flow works for guests.

Do I need CAPTCHA on every page that lists ads?

No. The setting is intended for forms where a sensitive action takes place: submitting a new listing and, if needed, sending a contact message. Showing the check on a directory page without a form does not improve protection and only makes the visitor’s path worse.

When WP Adverts reCAPTCHA is a good fit

This add-on is a good fit when WPAdverts already powers your classifieds site and you want to control public submissions without rebuilding the project. Its strength is its focused scope: keys are configured under Classifieds / Options / reCAPTCHA, the widget appears at the end of the selected form, and the site owner can combine it with moderation, role-based access, and built-in filters.

Before launch, do more than save the settings. Complete the form as a guest and as a test user, check the listing status in the dashboard, and test the contact flow if you use it. Then you can download the installation file and first add it to a controlled test page, then to the main classifieds site. This approach keeps submissions convenient for contributors and gives administrators a level of protection they can observe and verify.