How to Protect a Systeme.io Form With reCAPTCHA in 2026
Protect exposed Systeme.io forms with reCAPTCHA before bot signups damage list quality or reporting. Configure the production domain correctly and use the Script embed method on external pages when CAPTCHA protection is required.
Use reCAPTCHA when a public form is exposed to automated signups
A public opt-in form can attract automated submissions that add invalid addresses to your database, distort campaign reporting and create deliverability problems. Systeme.io specifically recommends reCAPTCHA as part of its protection against list-bombing attacks.
The goal is not to add friction everywhere. Protect forms that are publicly exposed or already receiving suspicious signups, then check whether the extra verification still keeps the signup experience acceptable on mobile and desktop.
Create reCAPTCHA v2 keys for the exact domain you publish on
Systeme.io's current setup guide directs you to Google's reCAPTCHA console, where you create a project, choose reCAPTCHA v2 and register the domain used by the form. Google then provides a site key and a secret key.
Use the real production domain rather than a placeholder. If the domain registered with Google does not match the page where the form is displayed, the verification can fail even when the Systeme.io settings look correct.
Add both keys to the domain settings in Systeme.io
Open the custom-domain settings in Systeme.io and enter the site key and secret key in the reCAPTCHA fields for the domain concerned. Save the settings before returning to the page editor.
Keeping the keys at the domain level makes the configuration easier to maintain across forms on the same domain. Treat the secret key as sensitive configuration and do not expose it in page copy, screenshots or public documentation.
Place the verification immediately before the form submission action
On supported Systeme.io pages, add the reCAPTCHA element after the information fields and before the submit button. This keeps the sequence understandable: the visitor completes the form, passes the verification and then submits.
After publishing, test the form as a logged-out visitor. Confirm that the verification loads correctly, the form can still be submitted and the new contact appears in Systeme.io with the expected tags or follow-up actions.
External embeds need the Script method if you want reCAPTCHA protection
Systeme.io's anti-list-bombing documentation warns that reCAPTCHA does not work with the stripped-down Embedded form HTML. For an external site, use the Script embed method when reCAPTCHA protection is required.
Also search old pages and templates for obsolete embedded-form code. Even if an old form is no longer visible, leftover code in the page source can remain a target for automated submissions until it is removed or replaced.
Combine bot protection with list-quality controls when the risk justifies it
reCAPTCHA verifies that a submission is more likely to come from a real person, while double opt-in verifies that the email owner confirms the subscription. The two controls solve different problems and can be combined on higher-risk acquisition forms.
Before scaling paid traffic, run a complete test from form submission to confirmation and follow-up email. A clean test protects both the contact database and the reporting you will later use to judge whether the campaign is actually converting.
Check these four signals.
✓The form is publicly exposed to meaningful traffic
✓Bot or invalid signups are appearing in the contact list
✓The production domain matches the Google reCAPTCHA configuration
✓External embeds use the Script method when CAPTCHA is needed
Need the bigger picture before choosing a plan?
Open the current offer and check Systeme.io pricing, limits and features before deciding on a subscription.
Official sources for this guide
Software pricing and features can change. Review the official documentation below before choosing a product or plan.
