reCAPTCHA

Documented accessibility barriers we are seeing with reCAPTCHA v2 that cannot be remediated by website owners due to the widget’s cross‑origin iframe implementation.We understand that:WCAG allows specific CAPTCHA exceptions under SC 1.1.1 reCAPTCHA provides audio alternatives and screen reader status messaging Many automated accessibility findings are false positives at the host‑page levelThat said, manual accessibility testing (including screen reader and keyboard testing) continues to surface issues that materially impact users with disabilities and are not addressable by implementers, including:Reliance on color‑only cues to communicate status or errors Dialog / modal semantics inside the challenge that are not programmatically exposed Focus handling during challenge open/close that i

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hello reCAPTCHA team and community,I’m posting to share documented accessibility barriers we are seeing with reCAPTCHA v2 that cannot be remediated by website owners due to the widget’s cross‑origin iframe implementation.We understand that:WCAG allows specific CAPTCHA exceptions under SC 1.1.1 reCAPTCHA provides audio alternatives and screen reader status messaging Many automated accessibility findings are false positives at the host‑page levelThat said, manual accessibility testing (including screen reader and keyboard testing) continues to surface issues that materially impact users with disabilities and are not addressable by implementers, including:Reliance on color‑only cues to communicate status or errors Dialog / modal semantics inside the challenge that are not programmatically exposed

Hi, I’m been facing into issue where when trying to validate a captcha token, I get a malformed token error. I’m not sure if its possible to gather more info on why its being malformed. It works when using a test site key, but once I switch to the prod site key it consistently returns a malformed error. tokenProperties: {createTime: "1970-01-01T00:00:00Z"invalidReason: "MALFORMED"valid: false}any help is appreciated  

So we have something along these lines “This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.” on all of our websites and forms. Are we good to remove this completely as of 2nd April, ofcourse we will be updating our privacy policy to cover the clause as well.Thanks

I want to create a reCAPTCHA v2 key, but there’s no option to select it on the creation screen in the Google Console.  Is it not possible to create a reCAPTCHA v2 key in the Google Console?

const { RecaptchaEnterpriseServiceClient } = require('@google-cloud/recaptcha-enterprise');async function createAssessment(token) {  const client = new RecaptchaEnterpriseServiceClient();  const projectPath = client.projectPath('YOUR_PROJECT_ID'); // رقم مشروعك في كلاود  const request = {    parent: projectPath,    assessment: {      event: {        token: token,        siteKey: 'YOUR_SITE_KEY', // مفتاح الموقع الخاص بنظامك      },    },  };  const [ response ] = await client.createAssessment(request);  // نظام الحشرة يقرر هنا:  if (response.riskAnalysis.score >= 0.7) {    // المستخدم حقيقي - مرر العملية    return { status: "success", access: "granted" };  } else {    // المستخدم مشبوه أو بوت - اطلق بروتوكول الحماية    return { status: "fail", reason: response.riskAnalysis.reasons };  }} 

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-

Hello folks!Hope this message finds you well :) I'm working on a production application that handles around 400k daily requests, and we are currently facing an intermittent issue with reCAPTCHA validation. Occasionally, when validating tokens using the /siteverify endpoint, we receive the following response:{ "success": false, "error-codes": ["invalid-keys"]} Context We are using reCAPTCHA v2 Invisible Tokens are generated on the client and validated server-side using /siteverify The application runs under a single domain The integration has been stable and unchanged for some time What we have verified The site key and secret key are correct and consistent Bot

I’m currently running a Morse Code translator website that performs real-time conversion of plain text into Morse code and vice versa using JavaScript on the frontend. The application includes dynamic input handling, instant visual dot-dash rendering, and optional audio playback for each Morse sequence. Recently, I integrated Google reCAPTCHA (v2 and later tested v3) to protect certain endpoints from spam and abuse particularly the API routes responsible for processing translation requests.Since implementing reCAPTCHA, I’ve started encountering issues where the real-time translation feature intermittently fails or becomes unresponsive. The problem seems to occur when the reCAPTCHA token expires or isn’t properly validated before asynchronous translation requests are triggered. In some cases, users typing quickly into the input field cause multiple parallel requests, and not all of them include a valid

I'm using Flutter web, AppCheck and reCAPTCHA enterprise. I would like to reduce the cost of reCAPTCHA enterprise and hence I would like to reduce the number of assessment requests.In Firebase, I've increased "Token time to live" to 7 days so I would assume that this would somehow halve the number of assessments (assuming that my users return at least twice a week). Is this assumption correct? Unfortunately, increasing the TTL from 1 day to 7 days does not seem to have any impact on the number of assessments requests.Can someone clarify when an assessment request happens and what can be done to reduce the number of requests?

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?  

Hi all, I’m using Firefox as my browser, but whenever I try to pass the reCAPTCHA v2 verification, I always get the image challenge (such as traffic lights or buses).Why does this happen? Is there any way to avoid getting the image challenges? Sincerely,Qimao

Hi! Previously, as per the FAQs, we were able to hide the reCAPTCHA badge on the site, so long as we referenced the branding in the user flow. Now that any references to Google’s Privacy Policy and Terms and Conditions need to be removed, do we need to display the badge at all times?   

Hi. Related to Switching Google’s role with reCAPTCHA from Data Controller to Data ProcessorI’m using Google recaptcha v2 with checkbox, so after 2 April, 2026, the badge with text Privacy - Terms will be removed from UI like this. is it right? Thank you for your supporting 

Hello Team,I’m using reCAPTCHA Enterprise on my website and, to avoid cookies, I’ve configured it to use the www.recaptcha.net source as recommended in Google's FAQ.However, I’ve noticed that some Google cookies, such as AEC and NID, are still being set under the www.recaptcha.net domain.Is there a way to completely avoid these cookies to ensure my platform remains compliant?Thank you!  

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.  This is the message I get over and over "success": false,    "error": "Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to\n535 5.7.8  https://support.google.com/mail/?p=BadCredentials a92af1059eb24-1276af2ea06sm10110769c88.7 - gsmtp",    "tip": "If this says 'BadCredentials', your .env password or email is wrong."}

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.

Hello dear community,  We are using  “I’m not a robot” checkbox from Google reCaptcha Enterprise and currently facing some issues from time to time. I hope the community and Google team can assist here.Sometimes our users encountering endless spinning on reCaptcha checkbox after clicking it. Some users waited 30, 40 seconds, then had to refresh the page and try again to click (later it passed well).Browser - Chrome No blocking extensions, happened also in incognito mode Not a case of additional challenge by reCaptcha, just keeps loading Below you can see a screenshot of it’s loading, taken after 30 seconds right after the click on the checkbox.  Did anyone else experienced this? I would appreciate any suggestions or solutions. Thank you!

 Hello Google reCAPTCHA Team, We are currently using the free version of Google reCAPTCHA, which has a limit of 50 allowed domains per key. We have already reached this limit with our existing customers. We are considering upgrading to reCAPTCHA Enterprise, which supports up to 250 allowed domains per key. However, we expect to eventually exceed the 250-domain limit as we onboard more customers.Could you please advise on the recommended long-term approach for this scenario? Specifically: Is it possible to manage domain validation within our application code (server-side) rather than relying solely on the domain allowlist configured in reCAPTCHA? If we exceed 250 domains, what are the supported options (for example, using multiple keys, alternative configurations, or other recommended best practices)?  Thank you,Kotreshi Sakragoudra

Hi everyone,I've been using Google reCAPTCHA v3 (enterprise) on my site for a while now, and until recently, everything was working fine. The token generated by recaptchased to be around 2k characters long, which I understand is normal for v3.However, starting four days ago, every token returned is consistently around 12,000 characters — and this happens on every single request. Nothing has changed on my end in terms of implementation.Has anyone else experienced something similar lately? Could this be related to a recent change on Google's end, or is there something obscure I might be missing?Thanks in advance for any help or insight!

Could someone explain the conditions under which riskAnalysis.reason is set to UNEXPECTED_ENVIRONMENT?I've read in the document below that`The event originated from an illegitimate environment.`https://docs.cloud.google.com/recaptcha/docs/interpret-assessment-websiteWhat criteria are used to determine an illegitimate environment?There are instances in the log explorer where the same tokenProperties.hostname results in UNEXPECTED_ENVIRONMENT in some cases but not in others.Is there an internal comparison of IPs happening?Is there something like a blacklist?Is there a rate limit imposed on an IP basis?Without understanding the cause of being marked as UNEXPECTED_ENVIRONMENT, it's challenging to a

Thanks for the update — this is a welcome change and brings reCAPTCHA in line with other Google Cloud services.Making customers the data controller and Google the data processor provides much clearer accountability and simplifies compliance under GDPR/POPIA. We’ll update our privacy notices accordingly and remove any references to Google’s Privacy Policy and Terms where applicable.Just to confirm: no technical changes are required, existing keys remain valid, and functionality is unchanged beyond the legal and badge updates?Appreciate the clarity on this transition.

Hi,I have successfully migrated my reCAPTCHA keys to Google Cloud Platform, but the reCAPTCHA Classic console still displays the "Migrate keys" message. I would like to confirm whether any additional action is needed on my end.Current situation:- GCP side: All keys have been migrated successfully. The status shows "Protected" — keys are requesting tokens and scores, and everything is configured correctly.- Classic side: The message "Migrate keys — Migrate your keys to Google Cloud Platform to access the latest reCAPTCHA features" is still displayed.- Monthly assessments: Approximately 1,140 (well within the free tier of 10,000).- Account: Upgraded from free trial to paid account in March 2021. Billing is enabled on the GCP project.My question:All keys have been confirmed as successfully migrated on the GCP side. Given this, is the "Migrate keys" message on the Classic console simply a display issue that will be resolved when Classic