Loading

Web-to-Case reCAPTCHA Setup Considerations and Known Behaviors

Publiceringsdatum: Jun 2, 2026
Beskrivning

Overview of Web-to-Case reCAPTCHA

While setting up Web-to-Case, administrators are often concerned about configuring reCAPTCHA and understanding its impact on web forms and case creation.

You can set up reCAPTCHA by following the "Set Up ReCAPTCHA" documentation to obtain the Site Key and Secret Key from Google.

Even though Salesforce leverages Google reCAPTCHA as a resource to support users and partners, there are several important considerations when configuring and testing Web-to-Case forms that use reCAPTCHA.

Important: reCAPTCHA Is Not Covered Under the Salesforce Main Services Agreement

Although Salesforce leverages Google reCAPTCHA as a resource to support users and partners, it is not considered part of the Salesforce Services for purposes of the Salesforce Main Services Agreement.

The considerations in this article are based on observed behavior when using Web-to-Case with reCAPTCHA. Salesforce Support can assist with standard Web-to-Case functionality and the HTML Generator. However, issues involving custom code, custom web pages, or third-party integrations may need to be reviewed by the affected organization's internal development team.

Lösning

Enabling reCAPTCHA on Web-to-Case

  • We recommend adding reCAPTCHA v2 to Web-to-Case forms to help prevent spambots from creating unwanted cases and affecting service operations.
  • The reCAPTCHA widget requires users to select the "I'm not a robot" checkbox before submitting a case.
  • If Require ReCAPTCHA Verification is enabled on the Web-to-Case Settings page, complete the required reCAPTCHA fields.
  • If you enable Require ReCAPTCHA Verification after previously generating Web-to-Case HTML, regenerate the HTML code to ensure the reCAPTCHA validation code is included.
  • Existing HTML generated before enabling reCAPTCHA will not contain the required validation code and may not create cases successfully.

Disabling reCAPTCHA While Keeping Web-to-Case Active

  • If you need to create a new Web-to-Case form without reCAPTCHA, disable Require ReCAPTCHA Verification in Web-to-Case Settings.
  • Also deselect Include reCAPTCHA in HTML on the Web-to-Case HTML Generator page before generating the new form.
  • Disabling reCAPTCHA for newly generated forms does not affect previously generated web forms.

Security Considerations When reCAPTCHA Is Modified Client-Side

  • If Require ReCAPTCHA Verification is disabled in Salesforce and a user modifies the HTML page by removing reCAPTCHA-related code, case submissions can still be processed.
  • This occurs because the HTML page hosting the form is outside Salesforce's control.
  • Organizations with additional security requirements may choose to implement custom client-side protections or other security controls on their web pages.
  • Such custom implementations are outside the scope of Salesforce Support.

Testing Web-to-Case HTML with reCAPTCHA

  • If you are testing by simply copying the generated HTML into a text editor and saving it as a local .html file, reCAPTCHA may fail to load correctly.
  • For proper testing, deploy the generated code within a hosted web page, custom website, or Visualforce page.
  • This allows reCAPTCHA resources and validation to function as expected.

Knowledge-artikelnummer

002575853

 
Laddar
Salesforce Help | Article