reCAPTCHA

Hi. We have been using reCaptcha enterprise on our site for years. 3 weeks back suddenly recpatcha started marking nearly every interaction as high risk. Its blocking almost all legitimate users from filling query forms on the website. What do we do about it?

Guys, I have no idea where I should put this questionLast month we received an e-mail telling us that our reCaptcha quota had been exceeded and we had 90 days to upgrade do Enterprise. Yesterday we received the second e-mail. In both e-mail we had over 1 million requests per month, and that number does not match our traffic volume. We use reCaptcha in our Azure AD B2C license. The url is similar to "https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/etc"  and all the other Azure AD B2C clients have their instances running in a URL similar to that "companyname.b2clogin.com/etc"This alert started when we implemented reCaptcha in our Registration form. We know that roughly 20k users get to this page monthly. We have the following questions before upgrading to Enterprise (because something seems to be wrong):1- what counts as a request for reCaptcha V2? If the widget is printed, the user interacts with it and then our backend verify the token, then 1, 2 or 3 reque

My clients with slow internet connections have encountered issues with passing reCaptcha. The issue can be reproduced by throttling internet connection speed (for example, to 2G) and attempting to pass reCaptcha. Requests to the reCaptcha API are aborted after 5 seconds on slow connections. I have tried to find a way to override this 5-second abort, but there is no information about it in the reCaptcha documentation.I would like to know if there is any way to increase this 5-second abort or some other way to handle slow internet connections in this case?Reproducible on demo (https://www.google.com/recaptcha/api2/demo) by throttling download speed to 40kbits and upload speed to 10kbits.    

The example provided on reCAPTCHA Enterprise frictionless assessment, uses the following rule to detect an action on the login page and allows it:request.path.matches(\\"/login.html\\") && token.recaptcha_action.score >= 0.8However, is not clear if the request.path on the rule refers to a Front-End (website) route or a backend route. If it refers to the latter: What is needed to craft an equivalent rule for a GraphQL endpoint? on GraphQL there is a single path /graphql using always the POST method for all the actions.Would be the rule below enough?token.recaptcha_action.action === 'login' && token.recaptcha_action.score>= 0.8What if an attacker decides to call directly to the API where reCAPTCHA Enterprise doesn't exists? Maybe I am missing some piece of information but I don't see how the tool would solve this problem for a GraphQL endpoint.Any comment is greatly appreciated! 

We are new to using reCAPTCHA enterprise and wanted to see if anyone has had firsthand experience on how to handle a situation when the reCAPTCHA endpoints are unavailable?Was there any try catch type code added to the webpage to avoid having issue at a later date?

Hello,I have implemented repatcha enterprise with the the score based assessment on on a register page.  At first a test website.Now I wonder what would be a non fraudulent score. If I use my email address I get a score of 0.89.Would it be ok if I assess all scores >= 0.7 as non-fraudulent? What would be a good starting point as a minimum score?I could log the scores and then compare the values over time. So I may could see what is a good minimum score.On the recaptcha enterprise website it states:"With low scores, require MFA or email verification to prevent credential stuffing attacks."Where could I set up MFA or email verification? Is there a documentation about it?Thank you for any recommendations. 

We had reCaptcha free for years. Around 6 months ago we've got notification that we are above the free threshold and we should move to the enterprise. In the last emails we had info that we have 800k above the limit (so in total 1.8M). 800k costs around 800$. We've moved to the enterprise version, had info that etimated billing is around 600$. Now after few days of usage estimated is 8000$. Hard to find explanation in the portal about the source of this spike. No spike in traffic, almost same levels as before. How to approach it?

reCAPTCHA has over a decade of experience defending the internet and data for its network of more than 5 million sites. reCAPTCHA Enterprise builds on this technology with capabilities, such as two-factor authentication and mobile application support, designed specifically for enterprise security concerns. With reCAPTCHA Enterprise, you can defend your website against common web-based attacks like credential stuffing, account takeovers, and scraping and help prevent costly exploits from malicious human and automated actors. And, just like reCAPTCHA v3, reCAPTCHA Enterprise will never interrupt your users with a challenge, so you can run it on all webpages where your customers interact with your services. In the video below, Customer Success Manager Nick Troutini, provides reCAPTCHA Enterprise users the information and resources you need to quickly gain cloud security confidence, stay up-to-date with the latest product updates, and find support when you need it. You can use the timesta

Hello,I'm having a weird issue with Recaptcha Enterprise's authentication using Service Keys. I keep getting an unauthorized error (code 7) as a response every time I try to create an assessment despite the fact the Service Key has the required role, and the Recaptcha Site Key also exists. I'm also sure the Service Key is being located correctly since replacing it with another one from a different project I worked on (along with the appropriate Site Key) leads to the correct behavior, where I get an assessment and can interpret the score.Any idea what could cause such an error? Could I have missed something (although I did follow the guide's steps)?

Hi,We recently added enterprise recaptcha to all of our sites. However, we are having a hard time tracking usage compared to the 1,000.000 free requests. What's the best way to setup a usage tracker for this?Which metrics should we be looking at to get an accurate picture of our current usage across the entire project? We have about 300 separate keys so we need it to be global. I've looked at these https://cloud.google.com/monitoring/api/metrics_gcp#gcp-recaptchaenterprise but not sure if this would include all the billable resources being used. We set up something with the Usage panel but it doesn't seem to match when I look at individual usage for keys.  Any ideas or help would be greatly appreciated.Thanks!

We are trying to setup ReCAPTCHA in Google Enterprise, and the system is asking for a secret key. Where we can locate it? I've already followed the steps in here: https://cloud.google.com/recaptcha-enterprise/docs/create-key   i am seeing no metrics here: https://console.cloud.google.com/security/recaptcha/  

Hi, we have taken over a website which has the free version of WP contact form. We need to add a reCAPTCHA so I went into Google Cloud Console. Created the key, entered the key ID and secret key into WP form settings and it shows error as 'error for site owner, invalid key type' never had this before I have deleted and done it again but the same issue. Any ideas anyone? We will be redoing the site but for now we need to do this for his existing form. Thanks in advance!

Wish you knew more about the basics of reCAPTCHA? Or do you have a new-hire that could benefit from an overview of reCAPTCHA and its use cases? Or maybe you simply want a refresher on all things reCAPTCHA...   Well, you're in luck! reCAPTCHA is hosting our Onboarding Webinar, and you're invited!   Our next session will be hosted on 8/2/2022 at 12pm MST. Please register here. (If you do not register, you will not receive the calendar and meeting invite).   This live session is for users of all levels and will provide you with the essential items and resources you’ll need to set you up for success with reCAPTCHA Enterprise.   You’ll learn: Where and how to get help with your technical questions or issues About the resources that are available to you at any time FAQs and how to address them ahead of time How to get connected with other peers and experts in the Security Community   Dedicated reCAPTCHA specialists will host this session and answer any questio

We're just 6 days away from reCAPTCHA hosting our first ever Onboarding Webinar! Make sure you and your team are registered and don't miss out.   The session will be hosted on 6/7/2022 at 12pm MST. Please register here. (If you do not register, you will not receive the calendar and meeting invite).   This live session is for users of all levels and will provide you with the essential items and resources you’ll need to set you up for success with reCAPTCHA Enterprise.   You’ll learn: Where and how to get help with your technical questions or issues About the resources that are available to you at any time FAQs and how to address them ahead of time How to get connected with other peers and experts in the Security Community   Dedicated reCAPTCHA specialists will host this session and answer any questions you may have. I am looking forward to meeting all of you as we kick off your reCAPTCHA journey!   Talk soon Nick

reCAPTCHA is hosting our first ever Onboarding Webinar, and you're invited!   Our next session will be hosted on 6/7/2022 at 12pm MST. Please register here. (If you do not register, you will not receive the calendar and meeting invite).   This live session is for users of all levels and will provide you with the essential items and resources you’ll need to set you up for success with reCAPTCHA Enterprise.   You’ll learn: Where and how to get help with your technical questions or issues About the resources that are available to you at any time FAQs and how to address them ahead of time How to get connected with other peers and experts in the Security Community   Dedicated reCAPTCHA specialists will host this session and answer any questions you may have. I am looking forward to meeting all of you as we kick off your reCAPTCHA journey!   Talk soon, Nick

Hey Google Cloud Security Community, Join us for the Google Cloud Security Summit on May 17 to learn from experts, explore the latest tools, and share our vision for the future of security. Discover new ways to define and drive your security strategy and solve for your biggest challenges. During the event, you’ll be able to: Gain insights from Google and partner security professionals on how you can move to zero trust architectures, bolster software supply chain security, and defend against ransomware and other emerging threats. Be among the first to explore new products and enhanced capabilities in cloud governance and digital sovereignty, and discover how Google is building toward our vision for the future of security operations. Uncover innovative approaches from your peers that can help solve your toughest security challenges during customer spotlights. Register today for this digital event and view the full agenda now. We look forward to seeing you there!  

Hi!I recently migrated a reCAPTCHA key to enterprise. Will I be able to see assessment results in the portal, or as a reply from the API call?