Here is something nobody talks about until it bites them: junk form submissions do not stay in your inbox and quietly rot. They fire your autoresponder sequences. They land inside your CRM as real-looking contacts with real-looking names. And by the time you notice, weeks have gone by and you have been paying to email a list that is partly garbage. I have cleaned up that mess on my own site, and it is not fun.
ESTAGE has now shipped a clean answer to this: site-wide reCAPTCHA v3 protection, switched on with a single toggle in your Genesis site settings. This post covers exactly what it does, why the invisible v3 approach matters for a hub-centric business, and the precise steps to get it live. If you are new to the platform and want context on what ESTAGE actually is before diving into individual features, that primer is a good starting point.
Why Invisible Verification Beats a Checkbox
Google's reCAPTCHA v3 runs silently in the background. It scores each visitor based on behaviour signals and turns away bots before a single form field is ever submitted. There is no puzzle. There is no checkbox. Real visitors never see anything at all.
That distinction matters more than it sounds. Older checkbox-style CAPTCHAs impose friction on every visitor, including your best prospects. If someone is on a mobile device, mid-scroll, and a puzzle pops up asking them to click every traffic light, a meaningful share of them will just leave. For a hub-centric business where the form is the conversion point, that friction is real cost. reCAPTCHA v3 protects the pipeline without touching the experience for real people.
How to Turn It On
The setup takes a few minutes, most of which is spent inside Google's admin console. Here are the exact steps:
- Open Settings then Recaptcha inside your Genesis site dashboard.
- Go to google.com/recaptcha/admin, create a new v3 key pair, and add the domain your site is actually published on.
- Paste both keys into the settings panel, switch Enable Recaptcha on, and press Save Changes. Every form on the site is covered from the next submission onward, including forms you add later.
The key is tested at save time. If Google does not recognise it, the system tells you immediately and leaves forms open rather than quietly blocking every real visitor. The most common mistake is pasting the Site key into both fields. The Site key and the Secret key are two different strings.
Good to Know Before You Save
If you already set up reCAPTCHA inside the classic ESTAGE builder, this uses the same project setting. Your keys are already filled in. All you need to do is press Save to switch protection on here too.
Keys are tied to a specific domain. Register the domain the site is actually published on, not a staging URL or a different property. A key from the wrong domain would reject real visitors alongside the bots. The settings panel shows you which domain to check against.
It is safe to save with only one key present. If just one key is filled in, your forms keep working exactly as they did before. No protection yet, but nothing breaks either. That makes it low-risk to set up in stages if needed.
This also covers forms you build after switching it on. You do not need to revisit the setting each time you add a new opt-in page or contact form. That is a meaningful detail for anyone running a site that grows over time. I have reviewed how the blogging and content side of the platform works separately in the ESTAGE blogging platform review, and the same principle applies there: platform features that work across the whole site without per-page setup are the ones that actually get used.
Frequently Asked Questions
Do visitors have to solve a puzzle or click a checkbox?
No. reCAPTCHA v3 is completely invisible. It runs in the background and scores each submission based on behaviour signals. Real visitors see nothing and do nothing extra.
What happens if I only fill in one of the two keys?
Your forms keep working exactly as they did before. No protection is active yet, but nothing breaks. You can save with one key safely while you locate the second one.
Could this accidentally block real visitors?
Only if the keys are registered to the wrong domain. Make sure the domain you add in Google's console matches the domain the site is actually published on. The settings panel shows you which domain to verify. If the key does not pass Google's check at save time, the system flags it immediately rather than silently rejecting visitors.
Does this cover forms I add to the site later?
Yes. Once the toggle is on, every form on the site is protected, including forms you build after the setting is saved. You do not need to revisit this setting each time you add a new page or form.
I already configured reCAPTCHA in the classic ESTAGE builder. Do I need to start over?
No. The Genesis settings panel uses the same project setting as the classic builder. If you set it up there, your keys are already filled in. Just open the Recaptcha settings and press Save to switch protection on.
What is the most common setup mistake?
Pasting the Site key into both fields. Google issues two separate strings: a Site key and a Secret key. They go in different fields. If the keys do not pass Google's validation at save time, the system will tell you rather than silently applying a broken configuration.
Where exactly do I find this setting inside ESTAGE?
Go to Settings, then Recaptcha, inside your Genesis site dashboard. The panel shows the domain to register and has separate fields for the Site key and Secret key, plus the Enable Recaptcha toggle and a Save Changes button.
If your lead pipeline runs through ESTAGE forms, this setting is worth ten minutes of your time right now. Junk contacts that have already fired your autoresponder and landed in your CRM are harder to clean up than they are to prevent. One toggle, two keys, and every form on the site is covered. That is the kind of leverage a hub-centric business needs from its platform.