The quick answer
This walkthrough uses a partner extension, Google reCAPTCHA Integration, installed as a bundle. Activate it for your domain in Commerce > Extensions > Extension Manager. Enter the site key and secret key from the Google reCAPTCHA admin console on the extension's reCAPTCHA Configuration record. Then go to Commerce > Websites > Configuration, open the extension's subtab under Extensions, check the forms to protect (registration, checkout, guest checkout), and save. Submit a whole-domain Cache Invalidation Request and test the store's registration form in a private window.
The screenshots show sample data. Person and company names are fictional. Use your own domain, keys, and extension when following the steps.
Before you start
In this example, the store Juniper & Vale runs on shop.juniperandvale.example, and Theo Marchetti uses the Administrator role in NetSuite. The Google reCAPTCHA Integration extension is already installed as a bundle but not active. Native SuiteCommerce also has its own CAPTCHA settings on the SuiteCommerce Configuration record. This procedure is for the partner extension, so don't also turn on native CAPTCHA for the same form. Field names belong to the extension, so check its installation guide.
Get the keys from the Google reCAPTCHA admin console first. Create a v2 "I'm not a robot" Checkbox key and list every storefront hostname as an allowed domain, such as the store domain and its www form, without https:// or paths. The example uses Google's reCAPTCHA test keys, which don't block anything; replace them with your own keys before production. The site key ends up in the storefront, but keep the secret key out of any file shoppers can download.
01. Look at the registration form first
Open the store's Log In | Register page. The New customer form asks for First Name, Last Name, Email Address, Password, and Re-Enter Password, then goes straight to Create Account. There's no reCAPTCHA.
02. Activate the extension for the domain
Go to Commerce > Extensions > Extension Manager. In this example, the Juniper & Vale row for shop.juniperandvale.example lists six active extensions, not including reCAPTCHA. Click Edit on the row. (A domain with no activation yet starts from New Activation.) On Activate Themes and Extensions, open the Extensions subtab, check Active for Google reCAPTCHA Integration, and click Activate. Extensions are activated per website domain.
Activation runs in the background and can take several minutes. It has to finish before the extension's settings appear in SuiteCommerce Configuration. Back on Extension Manager, the row's Active Extensions now include Google reCAPTCHA Integration - 1.1.1, and Status is Completed.
03. Enter the reCAPTCHA keys
This extension keeps its keys on its own custom record. In the example, the record list is opened from Recent Records as reCAPTCHA Configuration List. Click New reCAPTCHA Configuration and fill in:
- Site Key and Secret Key: the keys from the Google reCAPTCHA admin console.
- Google Captcha API URL: https://
www. google. com/ recaptcha/ api. js - Google Verify Captcha API URL: https://
www. google. com/ recaptcha/ api/ siteverify
Click Save.
04. Turn reCAPTCHA on in SuiteCommerce Configuration
Go to Commerce > Websites > Configuration. Select Juniper & Vale and shop.juniperandvale.example, and click Configure. On the Extensions tab, open the Google reCAPTCHA Integration subtab. Check Display reCAPTCHA for Registration, Display reCAPTCHA for Checkout, and Display reCAPTCHA for Guest Checkout, then click Save. Each form is a separate choice.
05. Clear the domain's cache
Configuration changes can take time to reach shoppers. Go to Commerce > Content Management > Cache Invalidation Requests and click New Invalidation Request. Check Juniper & Vale: shop.juniperandvale.example, move it to Selected Domains, choose Clear cache for the whole domain(s), and click Submit.
The new Manual request for shop.juniperandvale.example, path /*, goes from in progress to Processed.
06. Register with reCAPTCHA
Reload the Log In | Register page, ideally in a private window. The New customer form now shows the I'm not a robot check box above Create Account. Enter a new shopper's details (here Rowan Ellis, rowan.ellis@example.com, and a password), check I'm not a robot, and click Create Account.
The store opens My Account, with Rowan Ellis and rowan.ellis@example.com under Profile.
Check the result
- Extension Manager lists Google reCAPTCHA Integration - 1.1.1 for the domain, with Status Completed.
- The extension's subtab in SuiteCommerce Configuration has Registration, Checkout, and Guest Checkout checked.
- The whole-domain Cache Invalidation Request is Processed.
- The New customer form shows I'm not a robot, and a shopper who checks it can create an account.
Test the other forms
A successful registration only proves the registration form. Test checkout and guest checkout separately, on each storefront hostname, and try a test key in a sandbox before production. Also try submitting without checking the box to confirm the store refuses it.
If the check box doesn't appear, work back through the chain: activation Completed, keys saved, the right form checked for the right website and domain, and a Processed cache request. Then check that the hostname is on the Google key and that a browser extension or network filter isn't blocking Google's reCAPTCHA script. An admin who skips one of those steps ends up with keys saved and no protection on the store.
Common questions
How do I add Google reCAPTCHA to SuiteCommerce registration?
With a reCAPTCHA extension like the one here, it takes four places. Activate the extension for the domain in Extension Manager, enter the Google keys on its reCAPTCHA Configuration record, check Display reCAPTCHA for Registration on the extension's subtab in SuiteCommerce Configuration, and clear the domain's cache. Once the cache request is Processed, the New customer form shows I'm not a robot.
Where do I activate a SuiteCommerce extension for my domain?
In Commerce > Extensions > Extension Manager. Click Edit on the website and domain row, open the Extensions subtab, check Active for the extension, and click Activate. Activation runs in the background, so wait until the row's Status is Completed. A domain with no activation yet starts from New Activation.
Why don't my SuiteCommerce configuration changes show on the website?
The store can keep serving cached content for a while after a change. Submit a Cache Invalidation Request for the domain and wait for it to be Processed, then test in a private window. Also make sure the extension is active, and the setting saved, on the same website and domain you're looking at.
How do I clear the SuiteCommerce cache for a whole domain?
Go to Commerce > Content Management > Cache Invalidation Requests and click New Invalidation Request. Move the domain to Selected Domains, choose Clear cache for the whole domain(s), and click Submit. The request shows up as Manual and turns Processed when it's done.
Where do the reCAPTCHA site key and secret key go in NetSuite?
With this extension, on its own reCAPTCHA Configuration custom record, together with the Google script URL and verification URL. Other extensions may store them differently, so check the installation guide. Never put the secret key anywhere shoppers can download it.
Does reCAPTCHA on registration also protect checkout?
No. Registration, checkout, and guest checkout are separate checkboxes on the extension's subtab in SuiteCommerce Configuration. Check each form you want to protect, and test each one separately.
Which domains should I add to my Google reCAPTCHA key?
Every storefront hostname where the check box needs to work, such as the store domain and its www form. Enter the hostnames without the protocol or a path. If checkout runs on a different hostname, add that too.