If CAPTCHA or reCAPTCHA is enabled on pages requiring shopper input, then in most cases, the corresponding endpoints that send requests to the Magento server must include an HTTP header that contains a value entered by the shopper (for CAPTCHA) or generated by the Google API (for reCAPTCHA). However, if you specify an integration authorization token in the header of the endpoint, then you do not supply a header specific to CAPTCHA or reCAPTCHA.
The following table lists the forms that can be configured to require CAPTCHA. Go to Stores > Configuration > Customers > Customer Configuration > CAPTCHA > Forms to enable or disable CAPTCHA on these forms.
The endpoint that corresponds to a CAPTCHA-enabled form must include the HTTP
X-Captcha header, along with the text the shopper entered in response to the CAPTCHA challenge.
|Form name||REST endpoint|
|Add Gift Card Code||
|Applying Coupon Code||
|Contact Us||Not applicable|
|Payflow Pro||Not applicable|
|Send to Friend Form||Not applicable|
|Share Wishlist Form||Not applicable|
The following table lists the forms that can be configured to require reCAPTCHA. Go to Stores > Configuration > Security > Google reCAPTCHA Storefront > Storefront to enable or disable reCAPTCHA on these forms. If reCAPTCHA is enabled, unless an integration token is provided, always specify the HTTP
X-ReCaptcha header and the value generated by the Google API.
|Enable for Customer Login||
|Enable for Forgot Password||
|Enable for Create New Customer Account||
|Enable for Edit Customer Account||
|Enable for Contact Us||Not applicable|
|Enable for Product Review||Not applicable|
|Enable for Newsletter Subscription||Not applicable|
|Enable for Send To Friend||Not applicable|
|Enable for PayPal PayflowPro payment form||Not applicable|
|Enable for Braintree payment form||Not applicable|
|Enable for Checkout/Placing Order||