Recaptcha Enterprise scores dropped significantly since about a week

Hello, the team cannot help debug an issue specific to your app without knowing your Cloud project, reCAPTCHA key or app.

I suggest sending feedback from Google Cloud Console using the three-dots menu, followed by Send Feedback. Make sure the “Describe your feedback” text includes the reCAPTCHA key you need help with.

Hi Marc,

Apologies for the delay! We had one of our senior engineers on the scoring team take a look -- output below is from an AI agent summarizing their findings:

---

Hello Marc,

Thank you for reaching out to reCAPTCHA Enterprise support. We conducted a deep-dive investigation into the scoring trends for site key `6LdIriwqAAAAAFEJ1uNmphUD9cC_x_U4u1fv4aJi` (Project: `711716231307`) across early July 2026.

### 1. Summary of Findings
* **Traffic Surge & Rate Protections**:
  Between **July 2 and July 16, 2026**, your site experienced a temporary **~100x traffic volume surge** (peaking at ~6,100 requests/day compared to your normal baseline of ~50–80 requests/day), originating primarily from ChromeOS clients in the Netherlands.
* **Root Cause of Score Drop (False Positives)**:
  This sudden volume spike tripped reCAPTCHA's automated rate and velocity safeguards (`TOO_MUCH_TRAFFIC` and `UNEXPECTED_ENVIRONMENT`), including high distinct token issuance velocity from shared IP ranges and missing persistent partitioned cookies. These aggregate protections temporarily depressed real-time scores down to ~0.25 on legitimate traffic during that two-week peak.
* **Customer Annotations Ingested**:
  We confirmed that reCAPTCHA successfully received your **2,536 `AnnotateAssessment` feedback calls** marking sessions as `LEGITIMATE` between July 6 and July 13. While annotations do not dynamically override live scores in real time, they are actively ingested into our offline retraining pipelines to tune future model versions for your site.
* **Current Status (Resolved)**:
  Once the traffic spike subsided after July 16, your site's volume normalized (~50–80 req/day), the velocity penalties cleared, and average scores immediately returned to expected high levels (**> 0.92–0.96**).

### 2. Recommended Actions & Next Steps
1. **Audit Your Annotation Trigger Workflow**:
   * Because our real-time online detection models flagged strong automation indicators on this traffic wave (e.g. un-cookied ChromeOS environments and rapid token generation from concentrated IP pools), we strongly recommend auditing your backend `AnnotateAssessment` implementation.
   * Ensure that `AnnotateAssessment(Annotation.LEGITIMATE)` is strictly triggered only upon **confirmed, out-of-band verification of human legitimacy** (such as successful 2FA/MFA completion, verified payment/transaction, or authenticated session validation), rather than automatically marking requests as legitimate simply because they reached a backend endpoint or returned an HTTP 200 response.
   * If automated scraping traffic reaches a backend route that indiscriminately calls `AnnotateAssessment(LEGITIMATE)`, it can inadvertently inject noisy labels into your site's offline training profile.
2. **Pre-warming & Load Testing Keys**:
   * If future traffic spikes are planned (e.g. automated load testing or marketing launches), we recommend using dedicated reCAPTCHA testing keys (`IsTestSiteKey`) to avoid triggering production rate-limiting protections.
3. **No Production Changes Required**:
   * Your site key is currently healthy, and legitimate traffic is receiving expected high scores.
 

Some feedback:

• 6,100 requests/day is perfectly normal on weekdays: we had almost 10000 requests on May 18 (see screenshot).  Our application is used in schools so the baseline of 50-80 is only seen on weekends and in holidays (July/August in Belgium, slightly less in the Netherlands).  This also explain why the traffic early July only came from The Netherlands and not from Belgium anymore.

• 

  Note that I always get an “increase in traffic” warning on Mondays while this is also expected (and shouldn’t be alarming to the algorithm)

• So can you investigate why this was considered a sudden spike?

• shared IP-ranges are also typical for schools peaks are expected since all pupils in a class will start at the same time

• Can you elaborate on “missing persistent partitioned cookies” and “un-cookied ChromeOS environments”?  Can you give a pointer on how to add this?

• We currently only call “AnnotateAssessment(Annotation.LEGITIMATE)” for known IP addresses from schools that report having issues; so we use it as a kind of IP-whitelisting

Thanks for pointing me to the addIpOverride API!!