Shopify does not add CAPTCHA to your contact form or blog comment section by default. That means bots can submit your contact form, flood blog comments with spam links, and in some cases trigger repeated fake account signups. This guide covers how to add CAPTCHA protection to each of those areas, what Shopify already handles on your behalf, and which approach makes the most sense depending on your store’s setup.

Key Takeaways
1
Shopify protects checkout and customer logins automatically, but contact forms and blog comment sections have no built-in CAPTCHA.
2
You can add a math-based CAPTCHA to blog comment forms by editing your theme’s article.liquid file with a small jQuery snippet.
3
For contact form spam, a CAPTCHA-enabled form app from the Shopify App Store is the fastest fix with no coding required.

Does Shopify Have Built-In CAPTCHA?

Shopify includes some bot protection, but it is limited to specific parts of the platform. The checkout process and customer account login pages have Shopify’s own fraud detection running in the background. You do not need to add CAPTCHA to those pages yourself.

What Shopify does not protect automatically:

  • The native contact form (the one created by the contact page template)
  • Blog comment submission forms
  • Customer account registration (though Shopify does rate-limit signups)
  • Any custom form you have added via Liquid or a third-party app

That gap is where most Shopify merchants run into spam problems. A store might go months without issues, then suddenly start receiving dozens of fake contact form submissions or comment spam on blog posts. The solution is different depending on which form is being targeted.

How to Add CAPTCHA to Your Shopify Contact Form

Shopify’s default contact form is rendered through a Liquid template, and the platform does not give you a native way to attach Google reCAPTCHA to it. There are two practical routes: use a third-party form app that includes CAPTCHA, or add a honeypot field to the existing form via Liquid.

Option 1: Replace the Contact Form with a CAPTCHA-Enabled App

The simplest path is to install a contact form app from the Shopify App Store that includes built-in spam protection. Apps in this category typically offer Google reCAPTCHA v3 (invisible, no checkbox required) or v2 (the “I am not a robot” checkbox), along with honeypot fields and IP-based filtering.

When choosing an app, look for these features:

  • Google reCAPTCHA v3 support (invisible, so it doesn’t interrupt real users)
  • Honeypot field included by default
  • Email notifications with spam scoring
  • Ability to match the style of your existing theme

After installing, you’ll disable the default Shopify contact page template and point the contact page to the app’s form instead. Most apps walk you through this in their setup flow.

Option 2: Add a Honeypot Field to the Native Contact Form

If you prefer not to add an app, you can modify the native contact form in your theme’s Liquid files to include a hidden honeypot field. Bots fill in every field they see, including hidden ones, while real users never touch them. The server-side check then rejects any submission where the honeypot field has a value.

Here is how to add a basic honeypot to the Shopify contact form:

  1. In your Shopify admin, go to Online Store, then Themes.
  2. Click the three-dot menu next to your active theme and select Edit code.
  3. Open the contact.liquid template (or sections/contact-form.liquid depending on your theme).
  4. Find the opening
    tag and add this hidden field inside it:

This approach won’t stop sophisticated bots, but it blocks the vast majority of automated form spam with zero impact on real visitors. It works because simple bots parse the DOM and fill every input they find, regardless of whether it’s visible.

Note that Shopify’s backend does not process the honeypot check for you. If you go this route, you’ll need the form submission to pass through a server-side script that checks the honeypot value before forwarding to Shopify’s form handler. This is more complex and is one reason most merchants prefer the app route for contact form protection.

How to Add CAPTCHA to Shopify Blog Comments

If your Shopify theme has blog comments enabled, you can add a math-based CAPTCHA directly to the comment form by editing the article.liquid template. This approach has been used by Shopify merchants for years and still works on themes that support blog comments.

Here is the step-by-step process:

Step 1 - Log In to Shopify

Log into your Shopify admin panel using your store credentials.

Step 2 - Open the Theme Code Editor

Go to Online Store in the left sidebar, then click Themes. Next to your active theme, click the three-dot menu and select Edit code. This opens the template file editor.

Step 3 - Edit article.liquid

In the left file browser, look for the article.liquid file under the Templates folder (some themes place it under Sections as article.liquid or main-article.liquid). Click the file to open it.

Find the blog comment form section within the file. You need to add the following JavaScript above or just before the closing tag, or inside a

This version uses document.addEventListener("DOMContentLoaded") instead of jQuery’s $(document).ready(), which makes it work on themes that don’t load jQuery globally. It also uses parseInt for the answer comparison instead of eval(), which is safer practice.

Step 4 - Add the CAPTCHA Field to the Comment Form

Now find the comment form’s element in the same file and add the following HTML just before the submit button:

Update the JavaScript to also populate the visible label:

var displaySpan = document.getElementById("question-display");
if (displaySpan) {
  displaySpan.textContent = n1 + " + " + n2;
}

After saving both changes, open a blog post on your store and scroll to the comment form. You should see the math question field appear above the submit button. Test it by entering a wrong answer first to confirm the form blocks submission, then enter the correct answer to confirm it allows submission.

Blog Comment CAPTCHA Limitations

The math CAPTCHA approach works well for basic bot spam but has some real limitations worth knowing before you rely on it:

  • Sophisticated bots can bypass it. Bots that parse JavaScript, evaluate math, and fill form fields programmatically will pass a simple arithmetic challenge. This method stops the most common low-effort spam scripts, not targeted attacks.
  • It only works if your theme supports comments. Many modern Shopify themes have comments disabled by default. If the comment form doesn’t exist in your template, there’s nothing to protect.
  • Mobile users with JavaScript disabled won’t see the question. If someone has JavaScript off, the question field will be empty. You may want to add server-side validation to reject submissions where the answer field is blank.
  • The answer is calculated client-side. A determined attacker can inspect the page source and see the expected answer before submitting. For high-traffic blogs, a server-validated CAPTCHA (like reCAPTCHA) offers better protection.
  • It adds a small amount of friction for real commenters. Most users won’t mind a single math question, but it does add one extra step compared to no CAPTCHA at all.

For stores that are getting heavy comment spam despite this fix, the better long-term solution is a comment moderation plugin or switching to a hosted comments system that includes its own spam filtering.

What to Look for in a Shopify CAPTCHA App

If you’d rather use an app than edit Liquid code, the Shopify App Store has several options covering contact forms, registration pages, and general form spam. Here is what separates a solid CAPTCHA app from a weak one:

  • reCAPTCHA v3 support. Version 3 is invisible to users and scores each submission based on behavior. Only suspicious sessions get challenged. This is far better than v2’s checkbox approach, which real users find annoying over time.
  • Honeypot fields included. The best apps layer honeypot detection on top of CAPTCHA. This catches bots that might pass the CAPTCHA challenge but still fill hidden fields.
  • Covers multiple form types. Look for apps that protect contact forms, registration pages, and newsletter signups rather than just one form.
  • Doesn’t slow your page load. Some CAPTCHA implementations add significant JavaScript weight to every page. Check reviews for any comments about performance impact.
  • Logs blocked attempts. It helps to see how many spam submissions are being blocked. Apps that provide a spam attempt log let you verify the protection is working.

When evaluating apps, read the recent reviews and check whether the developer responds to support requests. CAPTCHA systems sometimes stop working after Shopify theme or platform updates, and active maintenance matters.

How to Protect Shopify Customer Account Signups from Bots

Bot account creation is a separate problem from contact form and comment spam. Bots sometimes register fake customer accounts to test stolen credit card details, claim discount codes, or inflate signup metrics. Shopify applies some rate limiting to account registrations, but it does not add visible CAPTCHA to the customer registration form by default.

There are a few approaches to reduce fake account signups:

Require Account Approval

In your Shopify admin, go to Settings, then Customer accounts. If you switch to “Classic customer accounts,” you get an option to require that customers request access before logging in. This is a manual approval step, which eliminates bot registrations entirely but adds work for you.

Add reCAPTCHA to the Registration Form

You can add Google reCAPTCHA to the customer registration form by editing the customers/register.liquid template in your theme. The process is similar to the blog comment approach: load the reCAPTCHA script, add the widget to the form, and verify the token on submission. This requires a Google reCAPTCHA site key and secret key, both free to obtain via the Google reCAPTCHA admin console.

The basic steps are:

  1. Register your domain at www.google.com/recaptcha/admin and note your site key and secret key.
  2. In your theme code editor, open customers/register.liquid.
  3. Add the reCAPTCHA script tag and widget div inside the registration form.
  4. Because Shopify processes the form server-side without a custom backend, full server-side reCAPTCHA token verification requires a Shopify app or a middleware function (e.g., a Shopify Function or third-party proxy). Client-side only is not sufficient for real security.

For most merchants, installing a dedicated bot protection or account security app is more practical than building this from scratch in Liquid.

Use a Bot Protection App with Account Registration Coverage

Some Shopify apps specifically target account creation bots. These apps can block registrations from known bot IP ranges, enforce email domain validation (blocking disposable email addresses), and add invisible CAPTCHA to the registration form. If fake account signups are a real problem for your store, this is worth investigating via the App Store search for “bot protection” or “customer account spam.”

Disable Public Account Registration

If your store doesn’t need public-facing customer accounts (for example, if you only sell wholesale via a private storefront), you can disable the registration page entirely. Under Settings, Customer accounts, you can choose “No accounts” to remove the registration and login flow completely, which also removes the attack surface.

For more along these lines, browse our guide to Shopify store safety and security.