How To Add Google reCAPTCHA To WordPress Comment Form Without Plugin

Generate reCaptcha API Keys

1. Open the Google reCaptcha website and click on the v3 Admin Console link to get your Site key and Secret API Key.

In the ‘Label’ section name it as you like. For example, you can name it My Site reCaptcha…
Then select the reCAPTCHA type, there are two versions reCaptcha v3 and reCaptcha v2. For Wordpress comment form, you should use reCaptcha v2.
Then in the Domain section enter your domain (you can add all your sites one by one).
Next, enter your email address and Accept the reCAPTCHA Terms of Service. Finally, click the “Submit” button.

You’ll have both the public and secret API keys on the next screen. Keep this window open, and we will need to copy them shortly.

Add reCaptcha With a Function

After successfully registering your site to Google reCaptcha you will need to customize your theme in WordPress.

Note Before editing your theme files, please take a backup of your whole site, if anything goes wrong you can recover your current site using the backup.

1. Navigate to Appearance -> Theme Editor and open the single.php file of your theme or child theme.

2. Then, copy the below code then paste it just before the get_header(); function in the single.php file then save the change.

wp_enqueue_script('google-recaptcha', 'https://www.google.com/recaptcha/api.js');

3. Once saved, open the functions.php file, scroll to the bottom of it, and paste the below code:

Note Don’t forget to replace line 5 and line 19 with the actual keys we generated earlier.

/**
Google recaptcha add before the submit button
 */
function add_google_recaptcha($submit_field) {
    $submit_field['submit_field'] = '<div class="g-recaptcha" data-sitekey="your_site_key"></div><br>' . $submit_field['submit_field'];
    return $submit_field;
}
if (!is_user_logged_in()) {
    add_filter('comment_form_defaults','add_google_recaptcha');
}
 
/**
 * Google recaptcha check, validate and catch the spammer
 */
function is_valid_captcha($captcha) {
$captcha_postdata = http_build_query(array(
                            'secret' => 'your_secret_key',
                            'response' => $captcha,
                            'remoteip' => $_SERVER['REMOTE_ADDR']));
$captcha_opts = array('http' => array(
                      'method'  => 'POST',
                      'header'  => 'Content-type: application/x-www-form-urlencoded',
                      'content' => $captcha_postdata));
$captcha_context  = stream_context_create($captcha_opts);
$captcha_response = json_decode(file_get_contents("https://www.google.com/recaptcha/api/siteverify" , false , $captcha_context), true);
if ($captcha_response['success'])
    return true;
else
    return false;
}
 
function verify_google_recaptcha() {
$recaptcha = $_POST['g-recaptcha-response'];
if (empty($recaptcha))
    wp_die( __("<b>ERROR:</b> please select <b>I'm not a robot!</b><p><a href='javascript:history.back()'>« Back</a></p>"));
else if (!is_valid_captcha($recaptcha))
    wp_die( __("<b>Go away SPAMMER!</b>"));
}
if (!is_user_logged_in()) {
    add_action('pre_comment_on_post', 'verify_google_recaptcha');
}

Finally, visit the comments section on one of your blog posts and verify that the reCaptcha box was added successfully. Go ahead and test the box by leaving a comment.