reCAPTCHA

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-

Hi! Previously, as per the FAQs, we were able to hide the reCAPTCHA badge on the site, so long as we referenced the branding in the user flow. Now that any references to Google’s Privacy Policy and Terms and Conditions need to be removed, do we need to display the badge at all times?   

Hi. Related to Switching Google’s role with reCAPTCHA from Data Controller to Data ProcessorI’m using Google recaptcha v2 with checkbox, so after 2 April, 2026, the badge with text Privacy - Terms will be removed from UI like this. is it right? Thank you for your supporting 

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?  

Hi, I’m been facing into issue where when trying to validate a captcha token, I get a malformed token error. I’m not sure if its possible to gather more info on why its being malformed. It works when using a test site key, but once I switch to the prod site key it consistently returns a malformed error. tokenProperties: {createTime: "1970-01-01T00:00:00Z"invalidReason: "MALFORMED"valid: false}any help is appreciated  

Hello Team,I’m using reCAPTCHA Enterprise on my website and, to avoid cookies, I’ve configured it to use the www.recaptcha.net source as recommended in Google's FAQ.However, I’ve noticed that some Google cookies, such as AEC and NID, are still being set under the www.recaptcha.net domain.Is there a way to completely avoid these cookies to ensure my platform remains compliant?Thank you!  

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.  This is the message I get over and over "success": false,    "error": "Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to\n535 5.7.8  https://support.google.com/mail/?p=BadCredentials a92af1059eb24-1276af2ea06sm10110769c88.7 - gsmtp",    "tip": "If this says 'BadCredentials', your .env password or email is wrong."}

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.

Hello dear community,  We are using  “I’m not a robot” checkbox from Google reCaptcha Enterprise and currently facing some issues from time to time. I hope the community and Google team can assist here.Sometimes our users encountering endless spinning on reCaptcha checkbox after clicking it. Some users waited 30, 40 seconds, then had to refresh the page and try again to click (later it passed well).Browser - Chrome No blocking extensions, happened also in incognito mode Not a case of additional challenge by reCaptcha, just keeps loading Below you can see a screenshot of it’s loading, taken after 30 seconds right after the click on the checkbox.  Did anyone else experienced this? I would appreciate any suggestions or solutions. Thank you!

 Hello Google reCAPTCHA Team, We are currently using the free version of Google reCAPTCHA, which has a limit of 50 allowed domains per key. We have already reached this limit with our existing customers. We are considering upgrading to reCAPTCHA Enterprise, which supports up to 250 allowed domains per key. However, we expect to eventually exceed the 250-domain limit as we onboard more customers.Could you please advise on the recommended long-term approach for this scenario? Specifically: Is it possible to manage domain validation within our application code (server-side) rather than relying solely on the domain allowlist configured in reCAPTCHA? If we exceed 250 domains, what are the supported options (for example, using multiple keys, alternative configurations, or other recommended best practices)?  Thank you,Kotreshi Sakragoudra

Hi everyone,I've been using Google reCAPTCHA v3 (enterprise) on my site for a while now, and until recently, everything was working fine. The token generated by recaptchased to be around 2k characters long, which I understand is normal for v3.However, starting four days ago, every token returned is consistently around 12,000 characters — and this happens on every single request. Nothing has changed on my end in terms of implementation.Has anyone else experienced something similar lately? Could this be related to a recent change on Google's end, or is there something obscure I might be missing?Thanks in advance for any help or insight!

Could someone explain the conditions under which riskAnalysis.reason is set to UNEXPECTED_ENVIRONMENT?I've read in the document below that`The event originated from an illegitimate environment.`https://docs.cloud.google.com/recaptcha/docs/interpret-assessment-websiteWhat criteria are used to determine an illegitimate environment?There are instances in the log explorer where the same tokenProperties.hostname results in UNEXPECTED_ENVIRONMENT in some cases but not in others.Is there an internal comparison of IPs happening?Is there something like a blacklist?Is there a rate limit imposed on an IP basis?Without understanding the cause of being marked as UNEXPECTED_ENVIRONMENT, it's challenging to a

Thanks for the update — this is a welcome change and brings reCAPTCHA in line with other Google Cloud services.Making customers the data controller and Google the data processor provides much clearer accountability and simplifies compliance under GDPR/POPIA. We’ll update our privacy notices accordingly and remove any references to Google’s Privacy Policy and Terms where applicable.Just to confirm: no technical changes are required, existing keys remain valid, and functionality is unchanged beyond the legal and badge updates?Appreciate the clarity on this transition.

Hi,I have successfully migrated my reCAPTCHA keys to Google Cloud Platform, but the reCAPTCHA Classic console still displays the "Migrate keys" message. I would like to confirm whether any additional action is needed on my end.Current situation:- GCP side: All keys have been migrated successfully. The status shows "Protected" — keys are requesting tokens and scores, and everything is configured correctly.- Classic side: The message "Migrate keys — Migrate your keys to Google Cloud Platform to access the latest reCAPTCHA features" is still displayed.- Monthly assessments: Approximately 1,140 (well within the free tier of 10,000).- Account: Upgraded from free trial to paid account in March 2021. Billing is enabled on the GCP project.My question:All keys have been confirmed as successfully migrated on the GCP side. Given this, is the "Migrate keys" message on the Classic console simply a display issue that will be resolved when Classic

Hey y’all!As of yesterday, I have been seeing a incredibly high false positive rate (blocking 100% of legitimate users in my testing). Specifically, this is impacting my iOS Web Views, which have a custom user agent string. This is not impacting my Android Web Views, which similarly have the custom user agent string, but also have the new sec-ch-ua* headers.I was wondering if there was a change to the reCAPTCHA model recently that would have caused a heavier weight to non-standard user agent strings. And if so, is that something that was intentional / what guidance would you give to remedy this.We are working on removing the custom user agent string, but that will require users to download the new version of the app to remedy the situation.Any insight,  guidance, or workaround would be greatly appreciated (outside of just disabling CAPTCHA for the time being).Thanks!

Hi,The reCAPTCHA that we were planning to migrate automatically has apparently been migrated automatically the other day.As a result, we have received an email from Google Cloud titled “Action Required: Accept Your Invitation to Manage reCAPTCHA on Google Cloud”.If we approve this, we currently have only one project that has an active reCAPTCHA contract—after clicking Accept/Approve, will the keys that were automatically migrated this time appear in that project?

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

I’m using reCAPTCHA v3 with Contact Form 7.The form is not submitting while captcha is enable. Existing forms submit successfully, but newly created forms fail with no visible error. It shows an error in orange box.Removing reCAPTCHA immediately resolves the issue.

We are raising this concern to the Google Cloud Security / reCAPTCHA community to understand whether the behavior we are observing is expected and to seek guidance on best practices.After deploying reCAPTCHA v3 to our UAT environment, we are consistently receiving lower scores compared to our QA environment, even though the same reCAPTCHA site key and secret key are used in both environments. The QA setup runs on a single server, whereas the UAT environment is deployed across multiple servers with different IP addresses.From an application perspective, the reCAPTCHA integration is functioning correctly in both environments. However, the score variation is impacting our ability to apply a consistent validation threshold.We would like to understand: Is it expected behavior for reCAPTCHA v3 scores to differ between a single-server setup and a multi-server setup with multiple IP addresses, even when using the same keys? Does reCAPTCH

Hi Team,We would like to seek clarification regarding the implementation of reCAPTCHA v2.We implemented reCAPTCHA v2 a few years ago and would like to confirm whether server-side validation was mandatory at that time. Based on the documentation available then, it does not explicitly state that Step 3 (server-side verification) was mandatory. We are referring to the documentation linked below.reCAPTCHA v2  |  Google for DevelopersPlease note that this clarification is specifically for our old implementation carried out in 2020. Kindly provide your response considering the documentation and circumstances that were applicable during that period, rather than the current implementation guidelines.

Hi all, I have one V2 Tickbox for years. It got automatically migrated towards the end of 2025, and I finally got around to having a closer look at the Google Cloud environment, which is completely new for me. Everything looks OK when accessed from the legacy google.com/recaptcha/admin reCAPTCHA administration. Also, the reCAPTCHA technically works, but I am not sure for how long. I have already enabled the free $300 testing period in Google Cloud and inserted the Credit Card details into the Google Cloud billing. But I am getting the following error when looking at Google Cloud → Security → reCAPTCHA administration page.The overview of Keys lists my key with a “Status” displayed as a dark grey/black circle followed by “Unknown” Once I open the detail at the “Overview” page, in the top right column, there is the dark circle with “Unknown” repeated and the below reads: “Something went wrong Unable to determine the status of

I’m trying to get reCAPTCHA to work on out custom HTML website. I wanted to use V3 enterprise but our website doesn’t use Word Press. My form is a simple one and uses an input for form submission. I’ve integrated the v3 Captcha but I don’t know how I can verify it.We use Namecheap hosting and I believe that I can use python but I can’t seem to figure out how to integrate it all to just work.Script in the head:<script src="https://www.google.com/recaptcha/enterprise.js?render=MY ACTUAL KEY"></script>Form:<form id="wf-form-Contact-Form" name="wf-form-Contact-Form" data-name="Contact Form" method="get" data-wf-page-id="6271900268b7c1836acc3047" data-wf-element-id="e23db74d-4c3c-4a5a-dcc3-e16717d2b392" data-turnstile-sitekey="0x4AAAAAAAQTptj2So4dx43e">

ecフォースというカート内でreCAPTCHAを設定しているのですが、先週からエラーになっておりました。おそらくサイトキーもしくはシークレットキーが更新されたからだと思うのですが、最初に設定した人が退職してしまったため、現在の正しいサイトキーとシークレットキーの確認方法がわかりません。reCAPTCHAの管理画面などあるのでしょうか？ご教示いただきたいです。

 In case If billing is generated for the customer, what is the billing cycle for reCAPTCHA?