What’s the Best Way to Integrate Google reCAPTCHA with Odoo Forms in v16/v17?

[vihanrichard]

Hi everyone,
I’m currently configuring Odoo 16 for a client’s website and portal, and one of our top priorities is improving form security—especially for login, sign-up, contact us, and newsletter subscription forms. While Odoo provides basic CAPTCHA options in some modules, we're looking to integrate Google reCAPTCHA (either v2 Checkbox or v3 Invisible) for more effective bot protection and spam filtering.
After some research, I noticed there are community modules available for Odoo reCAPTCHA, but not all seem actively maintained or compatible with the latest versions like Odoo 17. Has anyone here implemented Google reCAPTCHA in Odoo for both frontend and backend forms?
Specifically, I’m looking for input on:

• A reliable Odoo reCAPTCHA module that supports multi-website setups
  
• Best practices for embedding reCAPTCHA in custom forms or extended models (e.g., custom lead forms, job application forms)
  
• Performance impact and UX considerations when using Google reCAPTCHA v3 versus v2
  
• How to ensure compatibility with Odoo Website Builder, Odoo Portal, and Contact/Lead forms
  
• Backend setup steps: Where and how should the reCAPTCHA keys be added securely?
  

Additionally, if you’ve handled rate-limiting, brute-force protection, or added security layers through Odoo settings (e.g., password policies, IP blacklisting), I’d love to hear your complete strategy.
The goal is to ensure that our forms are not only secure from automated submissions but also remain user-friendly. It would be helpful to get insights on any third-party or enterprise-level Odoo CAPTCHA modules that offer more granular settings or native Google reCAPTCHA integration.
Thanks in advance to anyone who can share their implementation stack or code examples!

[bloomagency]

For Odoo 16 and 17, our recommendation is to use the native reCAPTCHA functionality wherever possible before introducing third-party modules. Odoo already supports reCAPTCHA v3 for website forms, which provides invisible bot protection without adding friction to the user experience.

A few best practices we've found effective:
• Use reCAPTCHA v3 for most public-facing forms (Contact Us, Sign Up, Newsletter, Lead Generation). Since it works in the background, conversion rates are typically better than with the traditional v2 checkbox.
• Store Site Key and Secret Key in Odoo settings, not in custom code or templates. This makes future maintenance and multi-website deployments much easier.
• For custom controllers and forms, validate the reCAPTCHA token server-side before creating records such as CRM leads, job applications, or portal registrations. Client-side validation alone isn't sufficient.

• Test thoroughly on Odoo 17 before deploying community modules originally built for Odoo 16. Odoo introduces significant framework changes between major releases, and older modules may require adaptation.

• Combine CAPTCHA with additional protections such as rate limiting, account invitation controls for sensitive portals, and web application firewall rules. CAPTCHA alone won't stop every abuse scenario. Community reports have shown that unprotected forms can generate large volumes of spam registrations and password reset requests.

For organizations running multiple websites or requiring protection on login, signup, password reset, and contact forms simultaneously, there are newer Odoo modules that support both reCAPTCHA v2 and v3 along with multi-domain configurations.

In most projects, our preferred approach is: native Odoo reCAPTCHA v3 + server-side validation + rate limiting + periodic monitoring of reCAPTCHA scores and form submissions. This provides a good balance between security, performance, and user experience.

Has anyone here compared Google reCAPTCHA against Cloudflare Turnstile on Odoo 17 for high-traffic websites? We're seeing increased interest in privacy-friendly CAPTCHA alternatives.