Add Google reCAPTCHA to the WordPress Login Form (No Plugin)

Quick answer: You can add Google reCAPTCHA v2 to the WordPress login screen with a short PHP snippet and no plugin — it renders the checkbox on wp-login.php and blocks any login attempt that fails verification. You need a reCAPTCHA v2 (“I’m not a robot”) site key and secret key from Google.

What this does

Brute-force bots hammer wp-login.php constantly. Adding reCAPTCHA means a login attempt only proceeds if Google confirms the request looks human, which stops automated password-guessing without adding a heavy security plugin. It hooks the reCAPTCHA widget onto the login form, then verifies the token server-side before WordPress authenticates anyone.

Get your keys first

At Google reCAPTCHA admin, register your domain and choose reCAPTCHA v2 → “I’m not a robot” Checkbox. You get a Site key and a Secret key.

The code

Add it as a PHP snippet (Code Snippets or WPCode), and replace YOUR_SITE_KEY and YOUR_SECRET_KEY with your two keys.

<?php
// 1. Render the reCAPTCHA v2 widget on the login form.
function hmwp_login_recaptcha_field() {
    ?>
    <script src="https://www.google.com/recaptcha/api.js" async defer></script>
    <div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY" style="margin-bottom:15px;"></div>
    <?php
}
add_action( 'login_form', 'hmwp_login_recaptcha_field' );

// 2. Verify the response before WordPress authenticates the user.
function hmwp_login_recaptcha_verify( $user, $username ) {
    // Only check when the login form was actually submitted.
    if ( empty( $_POST ) ) {
        return $user;
    }

    if ( empty( $_POST['g-recaptcha-response'] ) ) {
        return new WP_Error( 'recaptcha_error', __( '<strong>ERROR</strong>: Please complete the reCAPTCHA.' ) );
    }

    $secret_key = 'YOUR_SECRET_KEY';

    $response = wp_remote_post(
        'https://www.google.com/recaptcha/api/siteverify',
        [
            'body' => [
                'secret'   => $secret_key,
                'response' => sanitize_text_field( wp_unslash( $_POST['g-recaptcha-response'] ) ),
                'remoteip' => isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '',
            ],
        ]
    );

    if ( is_wp_error( $response ) ) {
        return new WP_Error( 'recaptcha_error', __( '<strong>ERROR</strong>: Could not reach reCAPTCHA. Try again.' ) );
    }

    $result = json_decode( wp_remote_retrieve_body( $response ) );

    if ( empty( $result->success ) ) {
        return new WP_Error( 'recaptcha_error', __( '<strong>ERROR</strong>: Invalid reCAPTCHA. Please try again.' ) );
    }

    return $user;
}
add_filter( 'wp_authenticate_user', 'hmwp_login_recaptcha_verify', 10, 2 );

How it verifies

On submit, the snippet sends the reCAPTCHA token to Google’s siteverify endpoint using wp_remote_post (the correct WordPress way to make an HTTP request — more reliable than raw file_get_contents). If Google does not return success, login is rejected with a clear error.

How to verify and undo

Log out and open the login page: the reCAPTCHA checkbox should appear, and submitting without ticking it should fail. To remove it, delete the snippet — the login form returns to normal.