Skip to content
Search Articles/

less than a minute read • Updated 5 hours ago

Set up reCAPTCHA with a custom subdomain

How to create your own Google reCAPTCHA keys and add them to Foxy when your store checkout uses a custom subdomain.

Google reCAPTCHA is now managed through the Google Fraud Defense console. If your Foxy checkout runs on a custom subdomain, you need your own reCAPTCHA keys rather than Foxy's shared ones. We strongly recommend this: without your own keys, a botnet-based card testing attack can cost hundreds or thousands of dollars in authorization fees.

Steps

  1. 1

    Go to the Google Fraud Defense admin area. You'll need to log in with your Google account if you aren't already.

  2. 2

    Click Create Key.

  3. 3

    Enter a Display name that makes it clear what these keys are for, such as "My Example Store on Foxy". This is just for your own reference.

  4. 4

    Leave Application type as Web.

  5. 5

    Click Add a domain and enter your Foxy custom subdomain in full. For example, if your checkout is at secure.example.tld, enter secure.example.tld.

  6. 6

    Click Next step (optional).

  7. 7

    Enable the Will you use challenges toggle and leave the default Tick box challenge enabled. You can set the challenge difficulty to Easy if you prefer.

  8. 8

    Click the save button at the bottom of the page.

  9. 9

    Google takes you to a page with setup instructions. Foxy's integration uses a legacy connection type, so you'll copy the keys manually:

    • The Site Key is at the top of the panel, shown as the string labelled ID next to the Display name you entered.

    • The Secret Key is available by clicking Integrate with a third-party service or plug-in.

  10. 10

    In the Foxy admin, go to Settings > Payments and click on your payment method set.

  11. 11

    Under Fraud protections, click on the Google reCAPTCHA entry (or click Add fraud protection + and select Google reCAPTCHA if it isn't there yet).

  12. 12

    Copy the two keys into the Site Key and Secret Key fields, making sure each key goes into its matching field.

  13. 13

    Close the panel to save your changes.

Test it

Set Configuration to Always enabled, load your checkout to verify the reCAPTCHA displays, optionally run a test transaction, then revert to Enabled by errors.

Notes

  • Google's older reCAPTCHA admin area created reCAPTCHA v2 "I'm not a robot" keys and asked for the root domain. That console has been replaced by Fraud Defense, and the new flow asks for the full subdomain instead. Existing keys created under the old console continue to work.

  • If your store uses multiple payment method sets, add the keys to the Google reCAPTCHA entry on each one.

  • See Configure reCAPTCHA on the checkout for configuration details.

Need Help?

Did this article answer your questions? Need help with anything? Please click below to contact us.