--- title: Guard Your Web Content from Abuse with reCAPTCHA and... description: A walkthrough shows how to integrate Google's reCAPTCHA into a Firebase-hosted web site using Cloud Functions for Firebase to verify challenge responses... canonical: https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Guard Your Web Content from Abuse with reCAPTCHA and Firebase | daily.dev og:description: A walkthrough shows how to integrate Google's reCAPTCHA into a Firebase-hosted web site using Cloud Functions for Firebase to verify challenge responses... og:url: https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4 og:image: https://api.daily.dev/og/posts/xuVUCIZI4.png og:image:alt: Guard Your Web Content from Abuse with reCAPTCHA and Firebase og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Guard Your Web Content from Abuse with reCAPTCHA and Firebase **[Firebase](https://daily.dev/sources/firebase-blog)** · 8 min read · 0 upvotes · 0 comments ## Summary A walkthrough shows how to integrate Google's reCAPTCHA into a Firebase-hosted web site using Cloud Functions for Firebase to verify challenge responses server-side. Steps cover creating a Firebase project, setting up hosting and functions directories, registering reCAPTCHA V2 keys, adding a reCAPTCHA widget to an HTML page, writing a Cloud Function that calls the reCAPTCHA verification API, and configuring hosting rewrites so the function appears under the site's own domain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I verify a reCAPTCHA V2 response using Cloud Functions for Firebase? Create an HTTPS Cloud Function that reads the response query parameter and makes a POST request to https://recaptcha.google.com/recaptcha/api/siteverify with your secret key and the response string, using the request-promise npm module. Check the result.success field to determine whether the user passed, and always send a response back to the client to avoid a function timeout. _daily.dev surfaces practical guides like this for developers wiring bot protection into their apps._ ### Why does the reCAPTCHA verification request need to go to recaptcha.google.com instead of www.google.com as shown in the docs? On the Firebase Spark (free) plan, outgoing HTTPS requests from Cloud Functions are restricted to a whitelist of hosts, and recaptcha.google.com is whitelisted while www.google.com is not. Using recaptcha.google.com as the API endpoint lets the verification call succeed without upgrading to a paid billing plan. _Developers hitting outbound network limits on serverless platforms can find these gotchas on daily.dev._ ### How do I map a Cloud Function URL to a custom path under my Firebase Hosting domain? Add a rewrites section to firebase.json specifying a source path and the target function name, for example mapping /checkRecaptcha to the checkRecaptcha function. After deploying, requests to that path on your Hosting URL are routed to the Cloud Function instead of exposing the separate cloudfunctions.net URL. _daily.dev helps developers configuring hosting rewrites and serverless routing find working examples._ ## Similar posts on daily.dev - [Introducing Google Cloud Fraud Defense, the next evolution of reCAPTCHA](https://daily.dev/posts/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha-8axi1s8rg) · Hacker News · 2 upvotes · 0 comments - [Enabling a safe agentic web with reCAPTCHA](https://daily.dev/posts/enabling-a-safe-agentic-web-with-recaptcha-igmjvhyfs) · Google Cloud · 0 upvotes · 0 comments - [Google Introduces Cloud Fraud Defense as Successor to reCAPTCHA](https://daily.dev/posts/google-introduces-cloud-fraud-defense-as-successor-to-recaptcha-ycb6rkntg) · InfoQ · 0 upvotes · 0 comments - [Firebase Phone Number Authentication in Kotlin/Wasm \(Part 3\)](https://daily.dev/posts/firebase-phone-number-authentication-in-kotlin-wasm-part-3--msdwsad0d) · ProAndroidDev · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#authentication](https://daily.dev/tags/authentication), [#firebase](https://daily.dev/tags/firebase), [#gcp-cloud-functions](https://daily.dev/tags/gcp-cloud-functions) [View this post on daily.dev](https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Guard Your Web Content from Abuse with reCAPTCHA and Firebase","url":"https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4"},"datePublished":"2026-08-23T12:21:23.665Z","dateModified":"2026-08-23T12:46:48.803Z","description":"A walkthrough shows how to integrate Google's reCAPTCHA into a Firebase-hosted web site using Cloud Functions for Firebase to verify challenge responses...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Firebase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Firebase","logo":"https://media.daily.dev/image/upload/s--i395oqZH--/f_auto,q_auto/v1787487448/logos/firebase-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/firebase-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript,authentication,firebase,gcp-cloud-functions","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Firebase","item":"https://daily.dev/sources/firebase-blog"},{"@type":"ListItem","position":3,"name":"Guard Your Web Content from Abuse with reCAPTCHA and Firebase"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/guard-your-web-content-from-abuse-with-recaptcha-and-firebase-xuvucizi4#faq","mainEntity":[{"@type":"Question","name":"How do I verify a reCAPTCHA V2 response using Cloud Functions for Firebase?","acceptedAnswer":{"@type":"Answer","text":"Create an HTTPS Cloud Function that reads the response query parameter and makes a POST request to https://recaptcha.google.com/recaptcha/api/siteverify with your secret key and the response string, using the request-promise npm module. Check the result.success field to determine whether the user passed, and always send a response back to the client to avoid a function timeout. daily.dev surfaces practical guides like this for developers wiring bot protection into their apps."}},{"@type":"Question","name":"Why does the reCAPTCHA verification request need to go to recaptcha.google.com instead of www.google.com as shown in the docs?","acceptedAnswer":{"@type":"Answer","text":"On the Firebase Spark (free) plan, outgoing HTTPS requests from Cloud Functions are restricted to a whitelist of hosts, and recaptcha.google.com is whitelisted while www.google.com is not. Using recaptcha.google.com as the API endpoint lets the verification call succeed without upgrading to a paid billing plan. Developers hitting outbound network limits on serverless platforms can find these gotchas on daily.dev."}},{"@type":"Question","name":"How do I map a Cloud Function URL to a custom path under my Firebase Hosting domain?","acceptedAnswer":{"@type":"Answer","text":"Add a rewrites section to firebase.json specifying a source path and the target function name, for example mapping /checkRecaptcha to the checkRecaptcha function. After deploying, requests to that path on your Hosting URL are routed to the Cloud Function instead of exposing the separate cloudfunctions.net URL. daily.dev helps developers configuring hosting rewrites and serverless routing find working examples."}}]} ```