CAPTCHA setup

CAPTCHA is Expeed Relay’s bot filter. When a site has CAPTCHA enabled, every browser submission must carry a valid token from the CAPTCHA provider or Expeed Relay rejects it before it becomes a submission.

Turn it on for any form that is publicly reachable — contact forms, quote requests, careers applications. You can leave it off for forms behind a login. The setting applies to every submission arriving on the public endpoint, including one posted by a server. It does not apply to the separate API-key endpoint your developer may use for server-to-server calls — the key is the authentication there — so turning CAPTCHA on does not affect an existing API-key integration.

CAPTCHA is configured per site, not per form. Every form on the site inherits the setting.

Choose a provider

Provider	What the visitor sees	How it decides	Best for
Google reCAPTCHA v2 (checkbox)	An “I’m not a robot” checkbox, sometimes an image challenge	Pass or fail, decided at the checkbox	Forms where a visible trust signal is fine, and you want a hard gate
Google reCAPTCHA v3 (invisible, score-based)	Nothing	Scores each request from 0.0 to 1.0; Expeed Relay rejects anything scoring below 0.5 — a server-wide setting your administrator can change, not a per-site one	High-traffic forms where you do not want to add friction
Cloudflare Turnstile	Usually nothing; occasionally a brief widget	Pass or fail, no image puzzles	Privacy-sensitive sites, or anyone avoiding Google

If you are unsure, start with reCAPTCHA v3. It adds no friction for real visitors, and you can switch later without changing anything on the form itself.

v2 and v3 keys are not interchangeable. Google issues a different key pair depending on which version you registered, and it is Google — not Expeed Relay — that rejects a mismatched pair. Expeed Relay does not check which version a key belongs to, so it cannot warn you: the failure comes back as a generic rejection rather than a configuration mistake. Register the version you intend to use, and pick the matching entry in the dropdown.

Get your keys

Every provider gives you two values: a CAPTCHA site key that is public and goes into the page the visitor loads, and a CAPTCHA secret key that must stay on the server.

Two different things are called a “site key”. Your Expeed Relay Site key identifies the site itself (expeed-marketing, say) and is set when you create the site. The CAPTCHA site key is issued by Google or Cloudflare and is unrelated. Your developer needs both, so name them explicitly when you hand them over.

• reCAPTCHA v2 or v3 — go to google.com/recaptcha/admin, register a new site, and choose the version deliberately: “Challenge (v2)” with the “I’m not a robot” checkbox, or “Score based (v3)”. Add every domain the form runs on, including any staging domain.
• Cloudflare Turnstile — in the Cloudflare dashboard, open Turnstile and add a site. Cloudflare issues the site key and secret key together.

Enable CAPTCHA on a site

1. Open Sites, click the site, and stay on the General tab.
2. Open the CAPTCHA provider dropdown. It defaults to None.
3. Choose Google reCAPTCHA v2 (checkbox), Google reCAPTCHA v3 (invisible, score-based), or Cloudflare Turnstile.
4. Paste the public key into CAPTCHA site key.
5. Paste the private key into CAPTCHA secret key.
6. Click Save changes.
7. Send the CAPTCHA site key and the provider version to your developer — they need both to render the widget correctly.

Screenshot to come

The General tab of a site with the CAPTCHA Provider dropdown open, showing the three provider options

Only the CAPTCHA Site Key is public. The CAPTCHA Secret Key is encrypted before storage and is never shown again after you save. If it ever appears in page source, browser network traffic, or a support ticket, treat it as compromised: generate a new pair at the provider and update both fields here.

The Secret Key field always looks empty

CAPTCHA secret key is write-only. Expeed Relay never sends the stored secret back to your browser, so the field is blank every time you open the page — even when a secret is saved and working. A blank box is not evidence that anything is missing.

Read the hint underneath the field instead. It says either “A secret key is stored” or “No secret key is stored”, and that is the only reliable indicator you have.

This gives the field three behaviours worth knowing:

• Leave it untouched and save — the stored secret is kept. This is what you want when you are only changing the site’s name or origins.
• Type a new value and save — the new secret replaces the old one.
• Type something into it, delete that again, and save — the stored secret is deleted. Merely clicking in and back out does nothing: the field only counts as cleared once you have actually edited it, which is what the hint means by “clear this field after editing it”.

Clearing the field while a provider is still selected will stop submissions. It does not quietly turn protection off. A site that names a CAPTCHA provider but has no secret cannot verify anything, so Expeed Relay refuses every browser submission for that site until you either paste the secret back or set CAPTCHA provider to None. If you mean to switch CAPTCHA off, change the provider dropdown — do not just empty the secret.

After you turn it on

Enabling CAPTCHA changes the contract with the website. Until the developer adds the widget and starts sending a token, every browser submission from that site will be rejected. Coordinate the switch:

1. Tell the developer which provider and version you selected, and give them the CAPTCHA site key.
2. Have them deploy the widget and token handling on the form.
3. Enable the provider in Expeed Relay.
4. Submit the live form yourself once, then check Submissions to confirm it arrived.

If you enable it first and the widget is not live yet, the form goes quiet. Watch Submissions after any CAPTCHA change — a sudden drop to zero is the signal that the token is missing.

Troubleshooting

• Every submission is rejected right after enabling. The widget is not sending a token yet, or the key pair does not match the selected version. Confirm with the developer that the CAPTCHA site key on the page is the same one stored here.
• The developer reports “CAPTCHA is misconfigured for this site”. A provider is selected but no secret is stored. Check the hint under CAPTCHA secret key — if it says “No secret key is stored”, paste the secret in and save. Nothing will get through until you do.
• The developer reports “CAPTCHA verification temporarily unavailable. Please try again.” This one is not your configuration. Expeed Relay could not reach Google or Cloudflare to check the token. It usually clears by itself; if it persists, raise it with your Expeed Relay administrator.
• Rejections mention a hostname mismatch. Expeed Relay cross-checks the hostname the provider reports against the site’s Allowed origins. If the form moved to a new domain, add that origin — see Creating a site.
• Real visitors are being blocked on v3. v3 scores traffic rather than challenging it, and some legitimate traffic scores low — corporate VPNs and privacy browsers especially. If this is affecting real users, switch the site to reCAPTCHA v2 (checkbox) or Turnstile, both of which give the visitor a way to prove themselves.
• You want CAPTCHA on one form only. Not supported — the setting is site-wide. Register a separate site for the form that needs different protection.

Turning CAPTCHA back off is instant and safe. Set CAPTCHA provider to None and save; submissions are accepted again immediately, and the developer can leave the widget on the page harmlessly until they remove it.

Related

• Creating a site — Allowed Origins feed the hostname check described above
• Configuring providers — CAPTCHA gates the submission; providers deliver it
• Submissions & jobs — confirm submissions are still arriving after a CAPTCHA change