Google reCAPTCHA on your website.
Does it load on every page?
reCAPTCHA loads from google.com and gstatic.com and connects the browser to Google as soon as the script is there. Version 3 runs invisibly in the background, often on every page instead of only at the form.
Your account after the first check

Sample shop. Every point opens its fix with the steps for your tool.
Where reCAPTCHA loads too early
reCAPTCHA is only needed when a form is sent. It often loads with every page.
- 01
Version 3 on every page
Some form plugins load reCAPTCHA v3 on every page, even where there is no form. The badge in the bottom right corner shows it.
Art. 5(3) Directive 2002/58/EC
- 02
Shop login and checkout
Shop systems and security plugins add reCAPTCHA before login, registration or checkout; built into the theme, it often loads on all pages too.
Art. 5(3) Directive 2002/58/EC
- 03
Contact form in the footer
If a form sits in the footer, reCAPTCHA loads with every page, before anyone even clicks the form.
Art. 5(3) Directive 2002/58/EC
Step by step
Measure
Open the page in a private window, developer tools (F12), Network tab, filter for “recaptcha” and reload without clicking anything. The report does this for every page it reads.
Only on the form page
In the form plugin, load reCAPTCHA only where the form is, or only once someone clicks into the form.
Or without Google
A captcha that works without any connection to Google, such as ALTCHA (open source, on your server) or Friendly Captcha (EU). Then nothing loads from google.com.
Measure again
Check the home page and a page without a form again without consent. Only when no request to /recaptcha is left there does it no longer load in advance.
Questions
Does reCAPTCHA need consent?
That is disputed; reCAPTCHA protects against abuse but connects the browser to Google. If it loads before the choice, the report lists it as a finding; the only sure way around the question is to load it only at the form or not from Google at all.
Is version 2 better than version 3?
Version 2 with the “I'm not a robot” box usually loads only at the form. Version 3 works invisibly and is more often built into every page. What counts is where it loads.
May I hide the badge?
Google only allows that with a notice text at the form. Hiding it does not change loading.
What a scan shows
It opens your website without consenting, also reads subpages and measures where reCAPTCHA loads. If it loads in advance, the report names the page and how to limit it to the form. Right away for your website: cookie check.
As of 15 November 2026. We name the reference so you can read it yourself; this is not legal advice.
More guides
- Cookies before consent: what ePrivacy requires
- Price information in web shops: unit price and shipping
- European Accessibility Act checker for web shops (WCAG)
- Cookiebot not working or not blocking?
- Usercentrics not blocking?
- Borlabs Cookie not blocking?
- Real Cookie Banner not blocking?
- Complianz not blocking?
- Check your cookie banner yourself in three steps
- Google Fonts self-hosted but still loading?
- Dark patterns in online shops: five patterns and the fix
- EU withdrawal button 2026: what your shop needs
- Unit price and the “order with obligation to pay” button
- GPSR: manufacturer information in your web shop
- OneTrust not blocking cookies?
- CookieYes not blocking or not working?
- Wix cookie banner check: does it really block?
- GTM consent: fire tags only after consent in Tag Manager
- Google Maps embed and GDPR: load the map only after a click
- YouTube embed and GDPR: load the video only after a click
- Google Analytics without consent?
- Meta Pixel before consent?
- TikTok Pixel before consent?
- Hotjar before consent?
- Microsoft Clarity consent mode: check what it sends
- HubSpot cookie banner not showing?
- Shopify cookie banner check: does it really block?
- Google Consent Mode v2 checker: test and set it up
- Cookie checker for websites: free, with the reject test
- Security headers check: free website security checker