You are here:
Set up reCAPTCHA for Your Provider Experience Cloud Site
Set up reCAPTCHA in the Experience Cloud sites to ensure that the provider applications are filled in by humans, not bots.
Required Editions
Available in: Lightning Experience Available in: Enterprise and Unlimited Editions with Health Cloud |
| User Permissions Needed | |
|---|---|
| To set up reCAPTCHA: | Provider Network Management for Experience Cloud Sites AND OmniStudio Admin |
Prerequisites:
- Enable Digital Experiences
- Create an Experience Cloud site
- Generate a Google reCAPTCHA site key, and copy the site key. For more information, go to Create reCAPTCHA keys for websites.
- From Setup, in the Quick Find box, enter Digital Experiences, and select All Sites.
- Click Builder next to the Experience Cloud site for your providers.
-
Configure the security settings:
- In the Settings section, select Security and Privacy.
- Under Security Level, select Relaxed CSP: Permit Access to Inline Scripts and Allowed Hosts from the dropdown.
- Make sure Lightning Locker is turned on.
- To add Google as a trusted site, click Add Trusted Site. For Name, enter Google. For URL, enter https://www.google.com. Make sure Active is selected, and then click Add Site.
- To add gstatic as a trusted site, click Add Trusted Site. For Name, enter gstatic. For URL, enter https://www.gstatic.com. Make sure Active is selected, and then click Add Site.
-
Add the Head Markup code:
- In the Settings section, select Advanced.
-
Click Edit Head Markup, and then paste this code:
<script src="https://www.google.com/recaptcha/api.js"></script><script type="text/javascript">/*** The custom LWC captcha component will fire 'grecaptchaRender' event to signal its readyness to show the Captcha.** Below handles that event, renders the captcha component on the div thats passed in, and sets it up to fire various events based on the captcha life cycle.*/document.addEventListener('grecaptchaRender', function(e) {grecaptcha.render(e.detail.element, {'callback': e.detail.callback,'expired-callback': e.detail.expiredCallback,'error-callback': e.detail.errorCallback,'sitekey' : e.detail.sitekey});});</script> - Save your changes.
-
Add Google and Gstatic to the list of trusted URLs in your org:
- In Setup, find and select Trusted URLs.
-
Click New Trusted URLs and add these URLs to the trusted URLs
list:
https://www.google.com
https://www.gstatic.com
- Save your changes.
-
From Setup, in the Quick Find box, enter Remote Site Settings, and
select it.
- Click New Remote Site and add these URLs to the trusted URLs list:
- Save your changes.
-
Add the CaptchaSiteKey to the Provider Registration Omniscript that you''ve added to the
Experience Cloud site previously:
- In the App Launcher, find and select OmniStudio.
- From the Omniscripts page, select either HealthCloudPNM/ProviderRegistrationWorkflow or HealthCloudPNM/ProviderRegistrationWorkflowWithNPPES.
- In the Omniscript Designer, click New Version to create a new version of the Omniscript.
- Select the Initialise Captcha set values element.
- Under Properties on the right pane, click captchaSiteKey, and in the Value field on the Edit Element Value page, add the site key that you generated and copied.
- Save your changes, and then click Activate Version
- Repeat these steps to add the CaptchaSiteKey to the Provider Nomination Omniscript that you''ve added to the Experience Cloud site previously: HealthCloudPNM/ProviderNominationWorkflow or HealthCloudPNM/ProviderNominationWorkflowWithNPPES.
-
Create sharing rules to make the CAPTCHA visible to the guest users.
- From Setup, in the Quick Find box, enter Sharing Settings, and then select Sharing Settings.
-
Create a sharing rule for the Omni Data Transformations object.
- Enter a label and rule name.
- Select the Guest user access, based on criteria rule type.
- Specify the criteria for sharing records, as required.
- Specify the users that you want to provide access to the data. For example, PNM Site Guest User.
- Set Read Only as the default level of access.
- Save your changes.
- Similarly, create sharing rules for these objects.

