reCAPTCHA

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-

Hello folks!Hope this message finds you well :) I'm working on a production application that handles around 400k daily requests, and we are currently facing an intermittent issue with reCAPTCHA validation. Occasionally, when validating tokens using the /siteverify endpoint, we receive the following response:{ "success": false, "error-codes": ["invalid-keys"]} Context We are using reCAPTCHA v2 Invisible Tokens are generated on the client and validated server-side using /siteverify The application runs under a single domain The integration has been stable and unchanged for some time What we have verified The site key and secret key are correct and consistent Bot

I want to create a reCAPTCHA v2 key, but there’s no option to select it on the creation screen in the Google Console.  Is it not possible to create a reCAPTCHA v2 key in the Google Console?

Hi, I’m been facing into issue where when trying to validate a captcha token, I get a malformed token error. I’m not sure if its possible to gather more info on why its being malformed. It works when using a test site key, but once I switch to the prod site key it consistently returns a malformed error. tokenProperties: {createTime: "1970-01-01T00:00:00Z"invalidReason: "MALFORMED"valid: false}any help is appreciated  

I’m currently running a Morse Code translator website that performs real-time conversion of plain text into Morse code and vice versa using JavaScript on the frontend. The application includes dynamic input handling, instant visual dot-dash rendering, and optional audio playback for each Morse sequence. Recently, I integrated Google reCAPTCHA (v2 and later tested v3) to protect certain endpoints from spam and abuse particularly the API routes responsible for processing translation requests.Since implementing reCAPTCHA, I’ve started encountering issues where the real-time translation feature intermittently fails or becomes unresponsive. The problem seems to occur when the reCAPTCHA token expires or isn’t properly validated before asynchronous translation requests are triggered. In some cases, users typing quickly into the input field cause multiple parallel requests, and not all of them include a valid

I'm using Flutter web, AppCheck and reCAPTCHA enterprise. I would like to reduce the cost of reCAPTCHA enterprise and hence I would like to reduce the number of assessment requests.In Firebase, I've increased "Token time to live" to 7 days so I would assume that this would somehow halve the number of assessments (assuming that my users return at least twice a week). Is this assumption correct? Unfortunately, increasing the TTL from 1 day to 7 days does not seem to have any impact on the number of assessments requests.Can someone clarify when an assessment request happens and what can be done to reduce the number of requests?

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?  

Hi all, I’m using Firefox as my browser, but whenever I try to pass the reCAPTCHA v2 verification, I always get the image challenge (such as traffic lights or buses).Why does this happen? Is there any way to avoid getting the image challenges? Sincerely,Qimao

Hi! Previously, as per the FAQs, we were able to hide the reCAPTCHA badge on the site, so long as we referenced the branding in the user flow. Now that any references to Google’s Privacy Policy and Terms and Conditions need to be removed, do we need to display the badge at all times?   

Hi. Related to Switching Google’s role with reCAPTCHA from Data Controller to Data ProcessorI’m using Google recaptcha v2 with checkbox, so after 2 April, 2026, the badge with text Privacy - Terms will be removed from UI like this. is it right? Thank you for your supporting 

Hello Team,I’m using reCAPTCHA Enterprise on my website and, to avoid cookies, I’ve configured it to use the www.recaptcha.net source as recommended in Google's FAQ.However, I’ve noticed that some Google cookies, such as AEC and NID, are still being set under the www.recaptcha.net domain.Is there a way to completely avoid these cookies to ensure my platform remains compliant?Thank you!  

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.  This is the message I get over and over "success": false,    "error": "Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to\n535 5.7.8  https://support.google.com/mail/?p=BadCredentials a92af1059eb24-1276af2ea06sm10110769c88.7 - gsmtp",    "tip": "If this says 'BadCredentials', your .env password or email is wrong."}

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.

Hello dear community,  We are using  “I’m not a robot” checkbox from Google reCaptcha Enterprise and currently facing some issues from time to time. I hope the community and Google team can assist here.Sometimes our users encountering endless spinning on reCaptcha checkbox after clicking it. Some users waited 30, 40 seconds, then had to refresh the page and try again to click (later it passed well).Browser - Chrome No blocking extensions, happened also in incognito mode Not a case of additional challenge by reCaptcha, just keeps loading Below you can see a screenshot of it’s loading, taken after 30 seconds right after the click on the checkbox.  Did anyone else experienced this? I would appreciate any suggestions or solutions. Thank you!

 Hello Google reCAPTCHA Team, We are currently using the free version of Google reCAPTCHA, which has a limit of 50 allowed domains per key. We have already reached this limit with our existing customers. We are considering upgrading to reCAPTCHA Enterprise, which supports up to 250 allowed domains per key. However, we expect to eventually exceed the 250-domain limit as we onboard more customers.Could you please advise on the recommended long-term approach for this scenario? Specifically: Is it possible to manage domain validation within our application code (server-side) rather than relying solely on the domain allowlist configured in reCAPTCHA? If we exceed 250 domains, what are the supported options (for example, using multiple keys, alternative configurations, or other recommended best practices)?  Thank you,Kotreshi Sakragoudra

Hi everyone,I've been using Google reCAPTCHA v3 (enterprise) on my site for a while now, and until recently, everything was working fine. The token generated by recaptchased to be around 2k characters long, which I understand is normal for v3.However, starting four days ago, every token returned is consistently around 12,000 characters — and this happens on every single request. Nothing has changed on my end in terms of implementation.Has anyone else experienced something similar lately? Could this be related to a recent change on Google's end, or is there something obscure I might be missing?Thanks in advance for any help or insight!

Could someone explain the conditions under which riskAnalysis.reason is set to UNEXPECTED_ENVIRONMENT?I've read in the document below that`The event originated from an illegitimate environment.`https://docs.cloud.google.com/recaptcha/docs/interpret-assessment-websiteWhat criteria are used to determine an illegitimate environment?There are instances in the log explorer where the same tokenProperties.hostname results in UNEXPECTED_ENVIRONMENT in some cases but not in others.Is there an internal comparison of IPs happening?Is there something like a blacklist?Is there a rate limit imposed on an IP basis?Without understanding the cause of being marked as UNEXPECTED_ENVIRONMENT, it's challenging to a

Thanks for the update — this is a welcome change and brings reCAPTCHA in line with other Google Cloud services.Making customers the data controller and Google the data processor provides much clearer accountability and simplifies compliance under GDPR/POPIA. We’ll update our privacy notices accordingly and remove any references to Google’s Privacy Policy and Terms where applicable.Just to confirm: no technical changes are required, existing keys remain valid, and functionality is unchanged beyond the legal and badge updates?Appreciate the clarity on this transition.

Hi,I have successfully migrated my reCAPTCHA keys to Google Cloud Platform, but the reCAPTCHA Classic console still displays the "Migrate keys" message. I would like to confirm whether any additional action is needed on my end.Current situation:- GCP side: All keys have been migrated successfully. The status shows "Protected" — keys are requesting tokens and scores, and everything is configured correctly.- Classic side: The message "Migrate keys — Migrate your keys to Google Cloud Platform to access the latest reCAPTCHA features" is still displayed.- Monthly assessments: Approximately 1,140 (well within the free tier of 10,000).- Account: Upgraded from free trial to paid account in March 2021. Billing is enabled on the GCP project.My question:All keys have been confirmed as successfully migrated on the GCP side. Given this, is the "Migrate keys" message on the Classic console simply a display issue that will be resolved when Classic

Hey y’all!As of yesterday, I have been seeing a incredibly high false positive rate (blocking 100% of legitimate users in my testing). Specifically, this is impacting my iOS Web Views, which have a custom user agent string. This is not impacting my Android Web Views, which similarly have the custom user agent string, but also have the new sec-ch-ua* headers.I was wondering if there was a change to the reCAPTCHA model recently that would have caused a heavier weight to non-standard user agent strings. And if so, is that something that was intentional / what guidance would you give to remedy this.We are working on removing the custom user agent string, but that will require users to download the new version of the app to remedy the situation.Any insight,  guidance, or workaround would be greatly appreciated (outside of just disabling CAPTCHA for the time being).Thanks!

Hi,The reCAPTCHA that we were planning to migrate automatically has apparently been migrated automatically the other day.As a result, we have received an email from Google Cloud titled “Action Required: Accept Your Invitation to Manage reCAPTCHA on Google Cloud”.If we approve this, we currently have only one project that has an active reCAPTCHA contract—after clicking Accept/Approve, will the keys that were automatically migrated this time appear in that project?

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

I’m using reCAPTCHA v3 with Contact Form 7.The form is not submitting while captcha is enable. Existing forms submit successfully, but newly created forms fail with no visible error. It shows an error in orange box.Removing reCAPTCHA immediately resolves the issue.

We are raising this concern to the Google Cloud Security / reCAPTCHA community to understand whether the behavior we are observing is expected and to seek guidance on best practices.After deploying reCAPTCHA v3 to our UAT environment, we are consistently receiving lower scores compared to our QA environment, even though the same reCAPTCHA site key and secret key are used in both environments. The QA setup runs on a single server, whereas the UAT environment is deployed across multiple servers with different IP addresses.From an application perspective, the reCAPTCHA integration is functioning correctly in both environments. However, the score variation is impacting our ability to apply a consistent validation threshold.We would like to understand: Is it expected behavior for reCAPTCHA v3 scores to differ between a single-server setup and a multi-server setup with multiple IP addresses, even when using the same keys? Does reCAPTCH