Skip to main content

New Introducing the Holiday Hub — seasonal templates and ideas to plan your holiday campaigns in one place.Introducing the Holiday Hub.Explore the Holiday Hub

Landing Pages Pop-ups Contests & Sweepstakes Refer-a-Friend Quizzes Social Media Instant Win Analytics Customize Everything 🎁 Free Tools View All Features
Pricing Templates
Blog Why ShortStack Enterprise & Agencies Help center
Start Free Today Book Demo Hire Us Log in to your account

Restricting entries using reCAPTCHA

Scale plan Last reviewed

Google reCAPTCHA scores every form submission from 0.0 (likely a bot) to 1.0 (likely a person). Set the lowest score your form accepts, set a stricter score for Instant Win prizes, and filter entries by score in the Entries Manager before you pick winners. You need your own Google reCAPTCHA keys. Turn it on in Campaign Settings → Security.

What you can do with reCAPTCHA

ToDo this
Stop bots from submitting entriesTurn on reCAPTCHA and set the Sensitivity Level.
Accept borderline entries but stop them winning Instant Win prizesSet a stricter score for Instant Win.
Leave low-scoring entries out of a winner drawFilter entries by score, then use the Random Entry Picker.
Protect voting as well as entriesTurn on reCAPTCHA in the Entry Display Widget too.

Before you start

  • reCAPTCHA needs the Scale plan or higher.
  • You need your own Google reCAPTCHA keys for campaigns published from January 26, 2026. Campaigns already published with reCAPTCHA before then keep working. See How to create Google reCAPTCHA keys.
  • A strict setting can block real people. Entries below the Sensitivity Level aren't accepted, so start low and adjust.
  • Google decides the score, not ShortStack, and doesn't share how it's calculated.

Turn on reCAPTCHA

  1. Open your campaign in the Campaign Builder.
  2. Click the gear icon on your Form Container to open its settings.
  3. In the Entry Restrictions tab, under Bot Prevention, click Configure in Campaign Settings → Security.
  4. Click Choose Profile, then select a saved profile or click Add to connect new keys.
  5. Tick Enable Google reCAPTCHA.
  6. Drag the Sensitivity Level slider to set the lowest score an entry needs to be accepted.

Saved keys are managed in the Entry Profiles Manager.

How scores work

Google gives every submission a score between 0.0 and 1.0:

  • 1.0: low risk. The visitor is most likely a real person.
  • 0.0: high risk. The visitor might be a bot or fraudulent.

The score is saved with each entry, so you can filter by it later.

Set a stricter score for Instant Win

Below the Sensitivity Level slider is a second slider for Instant Win. It sets the lowest score an entry needs to be eligible for an Instant Win prize.

  • Entries below the Instant Win score always lose, even though the entry itself is accepted.
  • The Instant Win slider only matters when it's higher than the Sensitivity Level. Set to the same value, both sliders reject the same entries.

Filter entries by reCAPTCHA score

  1. Open your list in the Entries Manager.
  2. In the Filters sidebar on the right, open Other.
  3. Drag the ends of the reCaptcha score slider to set a range, such as 0.5 to 1.0.
  4. Click Apply filters or press Enter.

Only entries in that score range are shown. Actions such as the Random Entry Picker, export and labeling then apply to just those entries. See How to select winners.

If something goes wrong

What you seeWhat to do
Real people say they can't enterThe Sensitivity Level is too strict. Lower it in Campaign Settings → Security. See Where are the entries?
Instant Win players always loseTheir score is below the Instant Win slider. Lower that slider, or leave it as is if those entries look suspicious.
The Instant Win slider doesn't change anythingIt only applies when it's higher than the Sensitivity Level. Raise it above the Sensitivity Level.
You can't turn on reCAPTCHAAdd your own Google reCAPTCHA keys first. See How to create Google reCAPTCHA keys.
reCAPTCHA doesn't work on an embedded campaignTick Enable if my campaign is embedded, and add your ShortStack publishing domain to your reCAPTCHA key, not your website's domain. See Bot and fraud prevention tools.

FAQs

Will reCAPTCHA block real people?

It can, if the Sensitivity Level is too strict. To keep borderline entries as leads, set a lower Sensitivity Level, set a higher score for Instant Win, and filter entries by score before you pick winners.

Why can't I see how Google calculates a score?

Google keeps its reCAPTCHA method secret so bots can't learn to get around it. See Google's guide to interpreting an assessment.

Does reCAPTCHA cost anything?

Not from ShortStack. Google includes 10,000 free reCAPTCHA uses per month. Usage above that is billed by Google directly to you.

Does reCAPTCHA work on votes too?

Yes. The Entry Display Widget uses the same key profile and Sensitivity Level slider as the Form Container.

Was this helpful?