Set up reCAPTCHA in PrestaShop 1.7 and 8 with eicaptcha

Reviewed on October 27, 2026 7 min read CAPTCHA spam PrestaShop

CAPTCHA systems are the most direct way to stop spam: the test that checks that whoever fills in the form is a person and not a robot. In PrestaShop they are especially necessary, because shops are a common target for bots that create hundreds of fake accounts a day and send contact forms in bulk.

The problem is not just having to delete those accounts. Bots use up the shop's CPU and memory, and every fake sign-up makes PrestaShop send a welcome email to non-existent Gmail, Hotmail and similar addresses. Those providers reject the messages and end up treating the shop's domain as suspicious, so your legitimate emails start landing in your customers' spam folder.

To protect the shop we will use the free eicaptcha module, which integrates Google reCAPTCHA into customer registration, the contact form and the newsletter subscription. It works with PrestaShop 1.7 and 8. If your shop is 1.6, follow the guide to reCAPTCHA in PrestaShop 1.6.

Download and install the module

Download the module from its official page on GitHub:

Published versions of eicaptcha

Download the eicaptcha.zip file of the latest 2.x version (currently 2.6.0), in the Assets section. Do not use the "Source code" links: that zip does not include the libraries the module needs and it will not work. The 0.4.x versions are the ones for PrestaShop 1.6.

In the PrestaShop back office go to Modules > Module Catalog (in PrestaShop 8, Modules > Module Manager), click Upload a module and drag the zip:

You can also unzip the file and upload the eicaptcha folder by FTP or from the cPanel File Manager to the PrestaShop modules folder.

If it was not enabled when installed, search for "captcha" and click Enable:

Then click Configure. The module asks for the reCAPTCHA keys, which we get in the next step.

Get the reCAPTCHA keys

Go to the reCAPTCHA admin console with a Google account (any Gmail account will do) and register a new site:

In Label type a name that lets you recognise it, for example the shop's domain.
In reCAPTCHA type choose one of the two:
- Challenge (v2) > "I'm not a robot" Checkbox: shows the familiar checkbox. It is the easiest to check.
- Score based (v3): invisible to the customer; only a small reCAPTCHA logo appears in the bottom right corner.
In Domains add the shop's domain, for example tutienda.com. reCAPTCHA also accepts its subdomains, such as www.tutienda.com.

Accept the terms and click Submit. Google will show you the site key and the secret key. Copy them and note which is which.

Google's interface has changed in appearance since these screenshots, but the fields are the same.

Configure the module

Go back to the eicaptcha settings and fill in:

Recaptcha Version: the same one you chose in Google (V2 or V3). If they do not match, the captcha will not work.
Captcha public key (Site key): the site key.
Captcha private key (Secret key): the secret key.
Enable the captcha on contact form and account creation, and on the newsletter if you use it.
Force Captcha language: your shop's language code, for example en.
With V3, Captcha V3 minimum score sets the minimum score for accepting someone as a person. Leave the default 0.5 and lower it to 0.3 only if real customers cannot register.

Save the changes. With v2 keys, the forms will show the "I'm not a robot" checkbox:

Check that it works

Open the shop in a private window and go to customer registration and the contact page: the reCAPTCHA checkbox must appear (or the logo in the corner with v3).
With v2, try to register without ticking the box: PrestaShop must show an error and not create the account.
Complete the registration normally: the account must be created.

If the captcha does not appear or does not block anything:

Clear the cache in Advanced Parameters > Performance.
On that same page, check that Disable all overrides is set to No. eicaptcha relies on an override of customer registration and, if overrides are disabled, it does not validate the form.
In the module's Advanced parameters tab, click Check if module is well installed and go back to that tab: it tells you what is failing (overrides, hooks, contact module). There you can also enable Enable Debug so that it keeps a log.
If you get the error "Invalid domain for site key", the shop's domain does not match the one registered in reCAPTCHA.

If fake accounts keep getting in

If fake sign-ups keep appearing after you enable the captcha, the bots are not going through the form: they are exploiting a flaw in the installed version, such as the mass registration flaw. Check the version in Advanced Parameters > Information and update the shop; if it is 1.7, the recommended step is to move to 8 or 9.

Fake accounts can usually be recognised because the first name or surname contains links or advertising text. Before deleting them in Customers > Customers, filter by registration date and check that they have no orders.