Choosing a reCAPTCHA v3 score threshold for checkout

You turned on reCAPTCHA v3 and now you have to pick a number. Most settings screens offer 0.5 as a default, and someone on a forum told you to use 0.7. Neither number is wrong, and neither is right for every store.

What the score actually is

reCAPTCHA v3 does not show a puzzle. It watches how the visitor uses the page and returns a score between 0.0 and 1.0 with each token. A score near 1.0 means Google thinks the visitor is likely human. A score near 0.0 means Google thinks the visitor is likely a bot.

Your server sends the token to Google, gets the score back, and decides what to do. Google does not block anyone for you. The threshold is your rule: scores at or above it pass, scores below it fail.

The score is a guess, not a measurement. It is based on signals you cannot see, and Google can change how it weighs them at any time.

What 0.5 means

Google suggests 0.5 as a starting point. At 0.5, you are only refusing visitors Google rates as more likely bot than human.

That is a fair default for a store that has not been attacked, or a store where a false block is expensive. Think of high-value orders, repeat business customers, or a lot of buyers on privacy browsers and VPNs. A lower threshold lets more real people through and also lets some bots through.

What 0.7 means

At 0.7, you only accept visitors Google rates as fairly confident human. That shuts out more scripts, and it also shuts out more real people who look unusual to Google.

Stores often move to 0.7 during an active attack, when the bot traffic keeps scoring between 0.5 and 0.7. That can be the right call for a few days. The cost is that some real customers will fail the check, and you will not always hear about it, because many of them just leave.

Why there is no universal number

The best threshold depends on things that are different for every store:

• Your customers. A store whose buyers use Brave, Firefox with strict tracking protection, or a corporate VPN will see lower scores for real people than a store whose buyers use plain Chrome on a phone.
• Your traffic volume. On low-traffic sites, scores tend to bunch around a few values instead of spreading out. Moving the threshold a small amount can change nothing, or change a lot.
• The attacker. A cheap script that sends no browser at all scores very low. A script running a real browser through residential proxies can score in the middle or higher.
• The cost of a mistake. Blocking one real customer on a $15 order costs less than blocking one on a $1,500 order. A missed bot costs gateway fees and puts your merchant account at risk.

How to pick yours

Use your own data instead of someone else's number. A reasonable process looks like this:

1. Start at 0.5, or run the check in a mode that logs scores without blocking, if your setup allows it.
2. Collect scores for a week of normal traffic. Look at the scores attached to orders you know are real.
3. During an attack, look at the scores the bot traffic gets. If it clusters well below 0.5, the default is already doing its job.
4. If bots score between 0.5 and your real customers, raise the threshold in small steps and watch completed orders.
5. Lower it again once the attack stops, unless your data shows real customers are not affected.

If your real orders and the bot traffic get the same scores, no threshold will separate them. That is a sign you need another layer, such as a rate limit or gateway fraud rules, not a stricter number.

Check more than the score

The score is only one field in Google's reply. Your server should also check that the token is valid, that the action name matches the one you set for checkout, and that the hostname is your store. A token from another page or another site can carry a high score and still be wrong for this request.

Also check the token age. reCAPTCHA tokens expire after two minutes, so a checkout page that fetches a token on load and then waits for the customer will fail. Fetch the token when the customer clicks to place the order.

Where Checkout Bouncer fits

Checkout Bouncer verifies the reCAPTCHA v3 token on the server for every checkout route, and keeps an events log with 7-day stats and CSV export. That log gives you something to look at before you move the number, instead of guessing.