Fraud Defense (reCAPTCHA)

We provide support for 100+ websites built on different technology and we need to plan for migrating reCAPTCHA to enterprise version. In that situation we need some clarification on new Google reCAPTCHA policy.We are using one google account with associated billing information. Under one project we have a number of domains. Can anyone please reply to the following queries?Now if we have 10 domains with reCAPTCHA keys is it correct that the free quota of 10K assessments are applicable on the total assessments of 10 domains together and not 10K x 10?Is it possible to associate a separate billing details for each project?Is there any limit of domains to be added per project?Is there any limit for adding projects per account? how many?Is it possible to increase the limit if needed?Where do we see the number

I have integrated Google reCAPTCHA Enterprise score based solution. Everything is working fine as expected. I am able get scores from reCAPTCHA enterprise. Next I am planning to enhance to use MFA. As per the documentation, we need to complete email verification and before that I have completed "Ownership Verification" of my domain. In Google Search Console, i can see a message "You are a verified Owner". But when I am trying to enable Sender Name and Sender E-Mail, still I am getting "Your ownership of this domain could not be verified. Please verify your domain in the Google Search Console."For eg. assume i have verified my ownership for domain https://example.com. and I used support@example.com as my sender email. But not sure why i am getting an error message as mentioned after completing site ownership verification.Wh

Hi there,We have been using ReCaptcha for a while now for the websites we create for our customers, and recently we have upgraded all keys to the new ReCaptcha enterprise.The "Protected Traffic" graph on the top of the page says there are 80,476 assessment requests in the past 30 days. We have about 150 recaptcha-keys, which would mean that in the past 30 days on avarage on every website 500+ calls were made.Is there a way to see how many recaptcha assessments per key were made, per day?I love the graphs for Google Maps API usage, but I would like to see where this 80K comes from. 

Description:Hello,I’m using reCAPTCHA Enterprise in my Android app. Everything works correctly when the app is installed directly from Android Studio or via a locally signed APK. However, when I distribute the app via Google Play Console (App Tester or internal testing), the reCAPTCHA flow fails with a “Site key invalid” error and shows an endless loading spinner.• The reCAPTCHA API is configured in Project B in Google Cloud.• The Android app is associated with Project A in Google Cloud.• The site key is configured with the correct package name, and the SHA-1 fingerprints (including the Google Play app signing certificate) have been added under API key restrictions.• Play Integrity API is not currently enabled in Project B where reCAPTCHA is configured.Questions:1. Can reCAPTCHA be used across different Google Cloud projects (i.e., app in Project A using reCAPTCHA from Project B)? I have a login module that is shared across mult

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

Hello everyone.We are operating a SaaS-based research platform where we collect data from customers through surveys and provide data analysis tools. In an effort to prevent bot responses on our survey response pages, we have integrated reCAPTCHA v3.Here is how we are currently using reCAPTCHA:1) When a user clicks the “Start Survey” button, we load the reCAPTCHA script to begin monitoring user behavior.2) When the user clicks the final “Submit Answer” button for the last question, we execute grecaptcha.execute() with the action name "submit" to retrieve a score.3) Based on the score, we assess whether the respondent may be a bot.However, we are currently facing some issues:1) Some legitimate users are receiving unexpectedly low scores.2) In contrast, automated scripts using Selenium are sometimes receiving high scores.We suspect tha

Hello everyone, We use the free version of reCaptcha V2 on an e-commerce site. Do you know how to be notified in advance of changes made by Google? Recently, certificate changes made by Google made our site unavailable several days before we detected it. Indeed, on April 21, 2025, between 12:00 PM and 2:00 PM: Google made a change to its certificates (Root and Level 2). The certificates changed names and were in the Elliptic Curve algorithm rather than RSA. On May 2, 2025, Google reversed course and switched back to RSA. If we use an enterprise version, are we informed of changes planned by Google in advance ?, or do you know of another way to be informed in advance (linked to the announced changes?) Thanks in advance 

 We're currently using Recaptcha Enterprise (score based) on a site. We're consistently seeing low scores (including 0) for legitimate traffic. For requests with low scores, we'd like to present a fallback puzzle. Is there a way to do this using the Recaptcha Enterprise product? Recaptcha V2 Invisible seems ideal for us. However, our organization is large and so it's possible we'd have over 100k assessments in a month. Is it possible to use Recaptcha V2 at the Enterprise tier if we are over 100k assessments? I'm a little confused about how the Recaptcha Enterprise product is related to the Enterprise tier. My hope is we can use the Enterprise tier without the Enterprise product if the Enterprise product doesn't support what we need.Thanks!

Hello, I hope you can assist me with a question regarding reCAPTCHA billing. I've reviewed the following documentation: reCAPTCHA Billing Information reCAPTCHA Pricing My question is about what happens when the free tier of 10,000 assessments combined is reached. Do I then need to pay $8 for each of my reCAPTCHA keys? Furthermore, does the 100,000 assessment limit apply individually to each reCAPTCHA key? For example, if I have two keys, would I have a limit of 100,000 assessments per key, totaling 200,000 assessments across both? Thank you for your time and clarification. Best regards, Martin

Hi Team,I'm currently implementing reCAPTCHA Enterprise on a web page within my application and have encountered an issue where the validation seems to expire after just 1 minute, rather than the expected 2-minute validity period as stated in Google's documentation.Here's how the flow works:A user interacts with the reCAPTCHA checkbox on the page.Once checked, my application calls an internal Web API.This API then sends a Captcha Verification Request and successfully returns a valid score.However, despite a successful verification, the validation expires right after 1 minute, and gives me a message "Validation failed, please try again"  — even though no additional action or reset is performed on the token.To troubleshoot:I reviewed Google's documentation and found the expected validity is 2 minutes.I removed all other JavaScript from the page to rule out script conflicts.I verified that there are no manual re

Hello everyone,I've followed the migration guide provided by google to migrate the recaptcha key to google cloud console.Everything appears to be setup correctly but there are a couple of things that I don't fully understand:1.- The Security > reCAPTCHA page shows a number of assesment request, currently 44. Is that the number that shouldn't go above 10.000 for free reCAPTCHA usage?2.- When I go to the specific migrated key I see this:My websites are using certain wordpress plugins that can only use recaptcha with site and secret keys, do I require some other modifications to this to work?I thought everything would be working they way it was and this was just a migration to google cloud console.Als

It’s an error popping up saying my account got phished and it says ERROR for site owner: Invalid site keyfor recaptcha so I need to talk an agent live chat about this issue being resolved 

Hello, we recieved an email saying that we will need to change the recaptcha and create a google cloud project for it to keep working. The email said that in the last 3 months my recaptcha average 327 assesments, but when I go to the recaptcha admin page I see 98,000 requests for the last 90 days.How does the pricing work for this? Does it charge when you reach X amount of requests or X amount of assesments? In this case assesments and requests are the same? If not what's the difference?Kind regards,  

I think reCAPTCHA has a bug for meim Trying to log into steam and I forgot my username, so I type my email and click I’m not a robot. It gives me what feels like thousands of prompts and then it tells me I’m a robot. I’m just trying to play my video games, I’m not a robot.

Hi,We are building a form service similar to Google Forms, where users can create custom forms and embed them into their websites via <iframe>.We’re currently implementing reCAPTCHA v3 to protect these embedded forms. Using the default implementation, the reCAPTCHA badge at the bottom left is as expected. We’d like better to localize the UI for Japanese users and our service.Current:What we’re trying to achieve We want to:1. Display the attribution text in Japanese, e.g.:```<div>  <img src="https://www.gstatic.com/recaptcha/api2/logo_48.png">  <div>

Hello Sir/madam I got this email that Google reCAPTCHA keys will need to be migrated to a Google Cloud project by the end of 2025. Assuming I forget to do the migration, will the recaptcha come to a grinding halt on my webpage?Thank you Karvesh

Hello, everyone!I am developing a website and would like to integrate reCaptcha into it. The FAQ states: "You are allowed to hide the badge as long as you include the reCAPTCHA branding visibly in the user flow. Please include the following text...".What exactly user flow means? Does it mean to include everywhere links for privacy and policy where I'm using it. I have Footer component which is visible everywhere, on all pages. There I have link to Terms of use for my web-app. Will it be enough for my page to state: "This site is protected by reCAPTCHA and the Google<a href="https://policies.google.com/privacy">Privacy Policy</a> and<a href="https://policies.google.com/terms">Terms of Service</a> apply." The link to this page is accessible from any page.

Hello, I am having a problem with reCAPTCHA v2 and v3. It seems that on all the websites where we have it installed, it has stopped working. I have tried all possible methods from reCAPTCHA tutorials, and I switched to version 2 to see if that would fix it.The error that is returned is browser_error, and it seems to always be the same. This error causes the form to be blocked, and it is not possible to submit it. Or, if I change the way the captcha is implemented and it allows submission, the token is invalid and it's not possible to complete the process.Why am I almost always getting an invalid token?Sometimes it works in Chrome, but in other browsers, it doesn't.

I have just upgraded my sites to reCAPTCHA V3 and the admin pages shows that I have Number of Requests as high as 1211 per day.  When I look on the Google Cloud console, it shows a count of 68 for the last 30 days under Protected Traffic.Based on the number of users I get to my site, the 68 number is more realistic.  I'm concerned I will hit the 10,000 limit based on the admin page.  I don't know where all these requests are coming from.Any help would be appreciated.Thanks

Since February 2025, reCAPTCHA v3 validation has stopped working on one of my websites, even though it was working perfectly from summer 2023 until February 2025. A client alerted me that they were unable to submit a form. Also note that I have other websites and reCAPTCHA works perfectly on them. I’ve checked all the usual points:✅ Correct version used (v3), keys properly placed✅ Domain correctly added in the reCAPTCHA admin console✅ Tested with different form plugins (Elementor + Fluent Forms)✅ Checked for possible conflicts (themes, plugins, updates)✅ No server-side blocking (curl test OK, no firewall issues)✅ Created several new keys on 2 different Google accounts → same issue: "Invalid key" or "Can not connect to the reCAPTCHA server (0)" At this point, I suspect a bug or soft-block on Google's side (maybe triggered by multiple key regenerations?), or possibly a doma

I attended a reCAPTCHA demo at Google Cloud Next, and it showcased how GCP reCAPTCHA protects websites from spam and abuse. It uses advanced risk analysis to detect bots, offering features like score-based assessments and mobile SDKs. The seamless integration with Google Cloud tools, like Cloud Armor, enhances security for high-traffic services. It’s a robust solution for enterprises.

Hi,I would like to migrate from V2 to Enterprise.However, I wouldn't like to get the score back, but to keep having the visible captch when needed.Is it possible?What should I change in the backend code?(currently querying https://www.google.com/recaptcha/api/siteverify and checking the success) 1 0 6

Once a key is created, I'm not finding how to add a domain to an existing enterprise key.I tried asking Gemini and providing it screenshots and it is stuck too, so I'm thinking this feature doesn't exist yet. If it does, please let me know where that is administered.

Hello,With the new Recaptcha dashboard, I am unable to generate the SECRET KEY and WEBSITE KEY to be entered on the Wordpress CONTACT FORM 7 plugin.Can you please help me out?Thank you very much.

Hi guysI have myproject v3 keys(pub and priv) and have myproject2 v3 keys(pub and priv)The problem is that when the "grecaptcha.executed();" instruction is executed, in the case when myproject v3 keys are used, a check for a fire hydrant(etc) appears on page if reCAPTCHA has the slightest doubt, but in same case with using myproject2 v3 keys - the check does not appear when working from the same browser and from the same tabDid according to docs# head<script src="https://www.google.com/recaptcha/api.js" async defer></script># body<div class="g-recaptcha"id="g-recaptcha"data-sitekey="{myproject v3 pub key}"data-size="invisible"># jsfunction execCaptcha(){try {    grecaptcha.execute();