Two external services, available when you actually need them. Under Settings → System → Integrations, you can connect Google Places to show Google reviews and a captcha provider to add another layer of spam protection to website forms. Neither is required for the website itself to work.
The native view of the Google reviews block uses this key to request your business rating and reviews from Google. The request is made server-side, so visitors do not see the API key. If you use the block with an externally embedded review widget instead, this key is not needed.
Google bills usage to your own Google Cloud project, so billing must be configured there. Demona does not show the saved key again later; the settings only indicate that a key is present.
Captcha protection applies to every public form on the website: the Contact form, Form builder, Appointment booking and Newsletter sign-up blocks, and footer layouts that include newsletter signup.
If the captcha or the server refuses a submission, the visitor gets the message in the language of the page they are reading, and an error that belongs to a field appears right under that field. If the captcha reports an error once, it restarts on its own, so the visitor can send the form with one more click.
Captcha is off by default, and for many sites that is enough. Even without a captcha provider, forms use several built-in protections: a hidden honeypot field that bots tend to fill, a minimum completion time, and submission limits per visitor and per website. Add captcha if spam is still getting through.
| Provider | What does the visitor see? | Visitor profiling | Price |
|---|---|---|---|
| Cloudflare Turnstile | A small verification box that usually completes automatically | No behavioural profiling | Free |
| reCAPTCHA v2 | The “I'm not a robot” checkbox | Uses Google signals | Free tier available |
| reCAPTCHA v3 | Nothing visible; Google scores the request in the background | Uses Google signals | Free tier available |
Comparison of the three available captcha providers
Demona's preferred option is Cloudflare Turnstile: it is free and avoids the behavioural profiling associated with Google's reCAPTCHA. If you use reCAPTCHA, make sure your privacy information reflects the data sent to Google.
When you save, Demona validates the secret key with the provider. If the provider rejects it, you see an error. A common cause is pasting the public site key into the secret-key field. The secret key is stored encrypted and is only sent server-side to the selected provider when needed.
Note: reCAPTCHA v2 and v3 use different key pairs and cannot share the same credentials. Switching provider removes the stored captcha key pair, so enter new keys for the provider you choose.
Quick fixes for Google reviews and captcha setup.
HELP
See how to let other people sign in and edit the website.