Fraud Defense (reCAPTCHA)

Hey y’all!As of yesterday, I have been seeing a incredibly high false positive rate (blocking 100% of legitimate users in my testing). Specifically, this is impacting my iOS Web Views, which have a custom user agent string. This is not impacting my Android Web Views, which similarly have the custom user agent string, but also have the new sec-ch-ua* headers.I was wondering if there was a change to the reCAPTCHA model recently that would have caused a heavier weight to non-standard user agent strings. And if so, is that something that was intentional / what guidance would you give to remedy this.We are working on removing the custom user agent string, but that will require users to download the new version of the app to remedy the situation.Any insight,  guidance, or workaround would be greatly appreciated (outside of just disabling CAPTCHA for the time being).Thanks!

Hi,The reCAPTCHA that we were planning to migrate automatically has apparently been migrated automatically the other day.As a result, we have received an email from Google Cloud titled “Action Required: Accept Your Invitation to Manage reCAPTCHA on Google Cloud”.If we approve this, we currently have only one project that has an active reCAPTCHA contract—after clicking Accept/Approve, will the keys that were automatically migrated this time appear in that project?

I’m using reCAPTCHA v3 with Contact Form 7.The form is not submitting while captcha is enable. Existing forms submit successfully, but newly created forms fail with no visible error. It shows an error in orange box.Removing reCAPTCHA immediately resolves the issue.

We are raising this concern to the Google Cloud Security / reCAPTCHA community to understand whether the behavior we are observing is expected and to seek guidance on best practices.After deploying reCAPTCHA v3 to our UAT environment, we are consistently receiving lower scores compared to our QA environment, even though the same reCAPTCHA site key and secret key are used in both environments. The QA setup runs on a single server, whereas the UAT environment is deployed across multiple servers with different IP addresses.From an application perspective, the reCAPTCHA integration is functioning correctly in both environments. However, the score variation is impacting our ability to apply a consistent validation threshold.We would like to understand: Is it expected behavior for reCAPTCHA v3 scores to differ between a single-server setup and a multi-server setup with multiple IP addresses, even when using the same keys? Does reCAPTCHA v3’s risk analysis consider server IP distribution or

Hi Team,We would like to seek clarification regarding the implementation of reCAPTCHA v2.We implemented reCAPTCHA v2 a few years ago and would like to confirm whether server-side validation was mandatory at that time. Based on the documentation available then, it does not explicitly state that Step 3 (server-side verification) was mandatory. We are referring to the documentation linked below.reCAPTCHA v2  |  Google for DevelopersPlease note that this clarification is specifically for our old implementation carried out in 2020. Kindly provide your response considering the documentation and circumstances that were applicable during that period, rather than the current implementation guidelines.

Hi all, I have one V2 Tickbox for years. It got automatically migrated towards the end of 2025, and I finally got around to having a closer look at the Google Cloud environment, which is completely new for me. Everything looks OK when accessed from the legacy google.com/recaptcha/admin reCAPTCHA administration. Also, the reCAPTCHA technically works, but I am not sure for how long. I have already enabled the free $300 testing period in Google Cloud and inserted the Credit Card details into the Google Cloud billing. But I am getting the following error when looking at Google Cloud → Security → reCAPTCHA administration page.The overview of Keys lists my key with a “Status” displayed as a dark grey/black circle followed by “Unknown” Once I open the detail at the “Overview” page, in the top right column, there is the dark circle with “Unknown” repeated and the below reads: “Something went wrong Unable to determine the status of your key. Try refreshing the page or checking back later.” The

I’m trying to get reCAPTCHA to work on out custom HTML website. I wanted to use V3 enterprise but our website doesn’t use Word Press. My form is a simple one and uses an input for form submission. I’ve integrated the v3 Captcha but I don’t know how I can verify it.We use Namecheap hosting and I believe that I can use python but I can’t seem to figure out how to integrate it all to just work.Script in the head:<script src="https://www.google.com/recaptcha/enterprise.js?render=MY ACTUAL KEY"></script>Form:<form id="wf-form-Contact-Form" name="wf-form-Contact-Form" data-name="Contact Form" method="get" data-wf-page-id="6271900268b7c1836acc3047" data-wf-element-id="e23db74d-4c3c-4a5a-dcc3-e16717d2b392" data-turnstile-sitekey="0x4AAAAAAAQTptj2So4dx43e"> <input class="text-field w-input" maxlength="256" name="name" data-name="Name" placeholder="Your N

ecフォースというカート内でreCAPTCHAを設定しているのですが、先週からエラーになっておりました。おそらくサイトキーもしくはシークレットキーが更新されたからだと思うのですが、最初に設定した人が退職してしまったため、現在の正しいサイトキーとシークレットキーの確認方法がわかりません。reCAPTCHAの管理画面などあるのでしょうか？ご教示いただきたいです。

 In case If billing is generated for the customer, what is the billing cycle for reCAPTCHA?

Hi Team,I am enabling billing for reCAPTCHA and selected UPI QR code as the payment method. After scanning the QR code, it shows “amount up to ₹15,000 will be auto-paid.”However, as per the email communication, reCAPTCHA billing is expected to start after 10,000 assessments, with an estimated charge of USD 8 per month(https://cloud.google.com/security/products/recaptcha?_gl=1*obre1b*_ga*NTUwODkzMzU5LjE3NDk2NDMyOTQ.*_ga_WH2QY8WWF5*czE3NjcwOTUzMTUkbzI4JGcxJHQxNzY3MDk2ODY5JGo2MCRsMCRoMA..#pricing).As per the image attached (recaptchabilling.jpg) Could you please clarify how the ₹15,000 auto-pay limit applies to reCAPTCHA billing? This is a critical request, and your prompt response would be appreciated.  

This query is regarding the recent Google reCAPTCHA migration. As per Google’s policy, the monthly free quota is 10,000 assessments, and charges apply only if this limit is exceeded. Our understanding is that if the quota is not exceeded, usage should reset at the start of each new calendar month and begin again from 1, 2, 3, etc.However, we are seeing inconsistent usage information in the Google Cloud Console:One screen shows usage based on “Last 30 days” (rolling data). Another screen (Billing → Current Month) shows no usage data and $0 cost.Due to this, it is unclear which view should be used to track monthly free-tier usage and billing.Please confirm:Whether the 10,000 free assessments are calculated per calendar month Whether usage resets every month Which console view reflects actual billable usage Thank you for your support.

Hi Team,We have created and linked a billing account in the Google Cloud Console for reCAPTCHA. However, we are still receiving an error message indicating that there are issues with the payment account.As this is a business-critical application, [removed by moderator] We kindly request your support to review and resolve this issue on a priority basis.

Hi Team,                       In case If billing is generated for the customer(us), what is the billing cycle for reCAPTCHA?

Hi Team,               What is the actual link to view Google reCAPTCHA assessment usage?

We have reCAPTCHA set up within the EC-Force cart system, but it has been showing an error since last week.We suspect this may be due to an update to the site key or secret key.However, the person who originally configured it has since left the company, so we are unsure how to verify the current, correct site and secret keys.Is there an admin panel or dashboard for reCAPTCHA where we can check this?We would appreciate your guidance.

I added a reCAPTCHA V3 in elementor, using the site and secret key but in Google its still saying I am missing something.  

I have migrated reCAPTCHA v2 to the Google Cloud Console. In the Google Cloud Console, where do I select the Essentials, Standard, and Enterprise billing tiers? Could you please share any documentation that explains this process?”

Hello guys! Got a few questions regarding the new reCAPTCHA changes done by Google.I did receive the email "We’re writing to inform you that all Google reCAPTCHA keys will need to be migrated to a Google Cloud project by the end of 2025..." as most of you probably already did.So far based on my research I am aware of the following, but you can confirm my questions please: 1. The existing V2 Checkbox, V2 Invisible and V3 keys will continue to work even after this change, however, Google is not specifying is they will automatically migrate the keys themselves, or what happens if the user does not migrate all the keys.  Will they still be available/working on the sites used? From my understanding, they are suggesting to migrate otherwise, the sites may loose protection if the reCAPTCHA service surpasses more than 10.000 requests (which is the Free tier limit).2. I noticed that when using the new Cloud view, the user can now create reCAPTCHA keys whi

I’m trying to integrate reCaptcha v 3 into our checkout page. It seems that no matter what I do the call to grecaptcha.enterprise.execute is always returning a token of 0.Here is the button event: function OnCCCard(e) {            e.preventDefault();            grecaptcha.enterprise.ready(async () => {                console.log('Getting Token');                const token = await grecaptcha.enterprise.execute('MyKey', { action: 'checkout' });                console.log('Got Token:' & token);            });        }No matter what I try the second console.Log always says : “Got Token: 0”I’m not sure what I’m doing wrong. 

Hi, We are in the process of setting up Google reCAPTCHA and are facing an issue related to URL filtering on our Palo Alto firewall. We created URL filtering rules to allow only recaptchaenterprise.googleapis.com, but reCAPTCHA is still not functioning as expected. During troubleshooting, access began working immediately after we removed the URL filtering restrictions, which confirms that the firewall had been blocking one or more additional Google domains required for reCAPTCHA validation. However, when we re-enabled the URL filtering policy and permitted only recaptchaenterprise.googleapis.com, the issue returned. This indicates that reCAPTCHA Enterprise relies on multiple backend Google domains, and allowing just this single URL is not sufficient for the complete validation workflow. To fully restore functionality, we may need to allow the complete Google reCAPTCHA domain set as recommended by Google, instead of permitting only a single hostname. Please advise on the exact list of d

Hi.I have three questions.①The email from Google Cloud said:“If you do not take action within 90 days of receiving this notice, your keys will automatically be associated with your Google Cloud project.”Even after 90 days have passed, they have not been automatically associated with a Google Cloud project.When will this happen? Did that notification have any meaning?②The email stated, “You will receive a notification when the association process is complete.”When the association is finished, will a notification be sent to the same address specifying which domain the process has been completed for? ③I understand that billing will begin with the month in which we exceed the free tier.Will the billing statement be sent by email or by postal mail?

Dear sirs:Some months ago I received an email from you telling me that my Google recaptcha keys were eligible for migration in a Google Cloud project.You also tell me that my average recaptcha monthly use is of 3 evaluations in three months.I suppose that this has a cost so in that case I wouldn't be interested in using recaptcha in my Wordpress anymore.What should I do to quit using recaptcha aside deleting it from my site?.Thank you very much in advance.Greetings,Eva

We’ve received your communication regarding the upcoming migration of reCAPTCHA keys from Classic to Google Cloud projects. We’d like to understand a few details to plan this transition smoothly for our customer and application environments.Could you please confirm if there are any changes in the billing model or pricing once the keys are migrated to Google Cloud? What kind of production or service impact can be anticipated during or immediately after the migration process? Is there any downtime expected or a recommended maintenance window for performing the migration? Will the existing API endpoints, site keys, or secret keys continue to work post-migration, or do we need to update configurations on our applications? Are there any new permissions or IAM roles required on the associated Google Cloud project to manage reCAPTCHA? Will there be any changes to logging or data retention policies once migrated? Finally, could you please share any migration checklist or best practices documen

Hi All ,    1 - We have 6-7 keys in old V2 admin console. We created a new google cloud project on the cloud console lets say “Cloud Project 1” . But on the old admin console, when we try to migrate the key to cloud, in the drop down we do not see the “Cloud Project 1”. We want to migrate our keys to this google cloud project, how can we ? 2 - By default it says “My project 5891” (this in in old, in cloud we do not have this project yet) , so if it try to migrate the key to this project, even after 2-3 mins nothing happened, it says some technical issue. This may be a temporary issue but just in case if any one has any idea for this. So we assume when we do this, a new project in cloud will be created with “My Project 5891”.3 - Our main goal is to migrate the keys to “Cloud Project 1” which was created in google cloud, so how can we migrate from old to new in this project ? Any settings needed in this project so that we can see it in the old console ? 4 - If we cannot migrate to “Cloud

Hello Google reCAPTCHA Team,We’re a psychotherapist running a solo practice in Poland and we need official confirmation about reCAPTCHA data retention periods for our privacy policy compliance with GDPR.Could you please provide official information about:1. How long does Google retain data collected by reCAPTCHA v2 and v3?2. Is the 30-day retention period mentioned in some sources accurate?3. Where can I find the official documentation for these retention periods?This information is crucial for my GDPR compliance documentation.Thank you for your assistance.