Enable Google reCAPTCHA Enterprise for Payment Pages 2.0
Learn how to enable Google reCAPTCHA Enterprise for Payment Pages 2.0 using Zuora's embedded iFrame solution to enhance security.
If you use Zuora's embedded iFrame solution, to enable Google reCAPTCHA Enterprise:
- On the configuration page for your payment page instance, navigate to the Security Information > Google reCAPTCHA section when you create or edit a Payment Page 2.0.
- Enable either the Interactive Test (Checkbox) version or AI Assessment (Score-based) version by selecting the option.
The following table describes the differences between these two versions. For details about the different versions of Google reCAPTCHA Enterprise, see Google reCAPTCHA Enterprise Docs.
|
User interaction required? |
User interaction data on hosted page collected by Google? |
Corresponding Google reCAPTCHA Enterprise key type | |
|---|---|---|---|
|
AI Assessment |
No |
Yes |
Score-based site key |
|
Interactive Test |
Yes |
No |
Checkbox site key |
The Interactive Test version protects the website through more friction than the AI Assessment version. For maximum security, we recommend that you enable the Interactive Test version . In the interaction flow, the I'm not a robot checkbox is always displayed and end users must click the checkbox to verify that they are not robots. Then Google determines whether to show the CAPTCHA challenge window. The risk score is used to evaluate whether the attempt is a bot attack, but not used to determine whether to show the challenge window.
The following image is an example of the I'm not a robot checkbox:
The following image is an example of the CAPTCHA challenge window:
For the AI Assessment version of Google reCAPTCHA Enterprise, the score returned by Google reCAPTCHA is based on user activity and data collected by Google algorithm. It is controlled by Google. Low risk score might be returned due to unusual traffic patterns or high volume requests. In your testing of payment pages that are configured with reCAPTCHA Enterprise AI Assessment version, the ReCaptcha_Validation_Failed error might occur as an expected behavior.
To discover what happened during the reCAPTCHA validation such as the IP address used and the risk score returned by Google, use the HPM reCAPTCHA Validation Result data sources to export relative data. For more information, see HPM reCAPTCHA Validation Result data source.
Google reCAPTCHA Enterprise is supported globally. After reCAPTCHA Enterprise is enabled on your tenant, CAPTCHA challenges will be supported on your Payment Pages 2.0 even though the Google service is not accessible to your tenant.
For Payment Pages 2.0 implemented through iFrame, Zuora also provides an opt-in HPM Smart Bot Attacking Prevention feature to dynamically enable and configure reCAPTCHA Enterprise Interactive Test (Checkbox) version by Zuora when attacks are identified.