orchardcore-recaptcha

Orchard Core ReCaptcha

The OrchardCore.ReCaptcha feature supplies Google reCAPTCHA rendering and verification. Add OrchardCore.ReCaptcha.Users when built-in user login, registration, and password recovery pages also need protection. It is not a replacement for authorization, rate limiting, or server-side input validation.

Guidelines

• Enable OrchardCore.ReCaptcha for the base service, settings, and shape.
• Enable OrchardCore.ReCaptcha.Users to protect user forms; it depends on the base feature and Users.
• Enable the Users registration or reset-password features separately when those pages must be protected.
• Store the site key and secret in secure configuration for production, not source control.
• Use the ReCaptcha shape or the <captcha /> tag helper to render a challenge.
• Use ValidateReCaptchaAttribute only for form posts that actually render and submit the challenge token.
• The Forms integration requires both OrchardCore.Forms and OrchardCore.ReCaptcha.
• The workflow validation task requires both OrchardCore.Workflows and OrchardCore.ReCaptcha.
• ReCaptchaService verifies the server response and retries its HTTP calls through the configured resilient client.
• All recipe JSON uses the root { "steps": [...] } format.

Enable the Base and Users Features

{
  "steps": [
    {
      "name": "Feature",
      "enable": [
        "OrchardCore.ReCaptcha",
        "OrchardCore.ReCaptcha.Users"
      ],
      "disable": []
    }
  ]
}

The Users feature registers IRegistrationFormEvents, ILoginFormEvent, and IPasswordRecoveryFormEvents. With the relevant Users subfeatures enabled it also provides display drivers for registration, forgot-password, and reset-password forms.

Configure ReCaptcha Settings

Navigate to Configuration → Settings → ReCaptcha and set the site key and secret key. ReCaptchaSettings exposes SiteKey, SecretKey, ReCaptchaScriptUri, and ReCaptchaApiUri. A usable configuration requires the keys and verification URI.