reCAPTCHA

I have installed the Advanced google reCAPTCHA plugin ver2 to my domain "aquilbiz.com" and it is working but login out from my wordpress dashboard and tried to login it does not work. And this is happening again and again for the last 2 weeks or so. I have also contacted my servive provider for the purpose and they make it error free and both my website dashboard and cPanel dashboard worked. I reconfigured the secret key and the other key, but after login out and then login again the links for both the wordpress dashboard and cPanel did not opened.I have tried edge, chrome and firefox browsers after clearing the history of these browsers but the results are the same as attached here attached here. I have also applied DOS commands such as ipconfig /flushdns, etc., but the result is the sameSomebody please helpRegards,Aquil

Hello, We are integrating reCAPTCHA with our application. What google domains we need to whitelist in our firewall to reach this service? Is there any documentation which specifies this? Any help is appreciated. Thanks.  

Should I use different site key, for example 3 sites key for web, android, and iOS for backend verification in reCAPTCHA enterprise?

We are a large e-commerce platform based in the UK, operating multiple brands and serving a significant volume of mobile users. We have integrated Google reCAPTCHA across our services to ensure secure and seamless user interactions.Over the past week, we’ve observed a noticeable decline in reCAPTCHA scores for a majority of our mobile users. This change is affecting user experience and access across our platforms.Could you please confirm if there have been any recent updates or changes to the reCAPTCHA system—particularly those that might impact mobile device behavior or scoring? We would appreciate any insights or guidance to help us to address this issue.Thank you for your support.Gobinathan Subramani |

Hello,I am trying to create a recaptcha enterprise widget to integrate in our applications. I thought I was succesful till I deployed it to acceptance. Then i got the following error: Invalid action name: only A-Z, a-z, and _ are allowed. The recaptcha id on TST contained only alphanumeric characters, while the id on acc en prd contained a '-'.  If I try again with the id from tst, then everything works again, but not on acc.Any idea what could be wrong in my code? Or is my code not working for the enterprise version of recaptcha? // Define interface for propsinterface RecaptchaEnterpriseContainerProps {    siteKey: DynamicValue<string>; // SiteKey as DynamicValue    token: EditableValue<string>; // EditableValue to interact with the Mendix attribute    onVerify: { execute: () => void }; // Callback for verification}// Component to handle reCAPTCHA Enterprise logicconst ReCaptchaEnterprise = ({    siteKey, 

Dear Community Members, 🎉 Welcome to the reCAPTCHA Enterprise Community! 🎉 We’re thrilled to have you here. Whether you’re a seasoned developer, a security enthusiast, or just curious about reCAPTCHA Enterprise, this community is the place to connect, learn, and share your experiences. What is reCAPTCHA Enterprise? With reCAPTCHA Enterprise, you can protect your websites or mobile applications from spam and abuse, and detect other types of fraudulent activities on the sites, such as credential stuffing, account takeover (ATO), and automated account creation. Let’s explore the powerful features that reCAPTCHA Enterprise offers: Score-Based and Checkbox Challenges: Prevent account takeovers (ATOs) by using score-based and checkbox challenges. These mechanisms assess user interactions and provide real-time risk scores, allowing you to take appropriate actions based on the level of risk. Multi-Factor Authentication (MFA): Verify an end user’s identity using MFA. This adds

I've been following advice from Gemini to setup Keys for Enterprise. However, despite extensive back and forth, I can't get any keys to complete, they all show incomplete.I've added the domains, checked IAM permissions etc. but I just can't get them to complete. The error I get in Chrome console is: App Check Setup Error: grecaptcha.enterprise object is UNDEFINED after delay. reCAPTCHA script loaded, but Enterprise features not available with this key/config.Gemini tells me this error is because the Key is incomplete and suggests I ask in the forum for help.Any ideas welcome!

We are integrating Google reCAPTCHA with our website; however, we notice that, if we call Google to verify an invalid/expired reCAPTCHA token, our Google reCAPTCHA assessment usage will also be deducted. This raises a security concern: supposing if a malicious user uses a Python Script and keeps calling our API using a random string as reCAPTCHA token, and we bring this token to Google for verification, our reCAPTCHA quota will be exhausted very quickly. If we are transited to enterprise tier, we will lose $1 after processing every 1000 calls from the hacker. If a hacker is using DDOS attack, we may suffer great lost.So we have question to Google: Why calling Google to verify an invalid/expired reCAPTCHA token is also counted in reCAPTCHA usage?What's the Google's suggestion to handle such case? According to our research, blocking IP may be a effective way to protect us from being attacked. However, blocking IP may also harm the normal user, if the normal user shares the same

We have recaptcha v3 enterprise implemented on our mobile applications, while using appium scripts or android ui automator , the score returned from the assessment is 0.9, though there are no human gestures and these scripts mimic the behavior of a bot.At present we are testing in a small sample space of <10 users, will this be more predictable as user base grows ?

Planning to migrate from google reCAPTCHA V2 to reCAPTCHA enterprise , Please send step by step proc

Hi, When attempting to download content from any of our blogs/resources (e.g., <URL Removed by Staff> in the Middle East, a 404 error appears. Or website support team suggests Google reCAPTCHA sometimes blocks access for users in certain regions, including parts of the Middle East, if it suspects the traffic may be suspicious. This can sometimes be triggered by factors such as device settings, browser extensions, or the use of a VPN, or the region in general. Is there any solution to resolving this? As we're worried that users in Middle Eastern locations might be affected. If that's the case, we could be missing out on important contacts for our teams, so resolving this is a priority. Regards, NES

I'm getting the following message.Finish setting up your key: Request tokens To protect your site or app, finish setting up your key. Start by requesting tokens (executes).My website is a Wordpress Site and I'm using the plugin WP Forms.  I have others I setup the same way and they say protected and I didn't have to request tokens.  what am I missing?

Hi, I've installed Recaptcha 3 on a Wordpress site that uses Job Manager. I've put the Recaptcha key into Job Manager and Recaptcha is confirming that it's set up correctly. But there is a bot that is repeatedly sending job applications in via the Job Manager form, and is not getting stopped by Recaptcha. I've tried fully deleting the job that the bot is attacking, but it just jumps to another one.The Job Manager developers have said it's a Recaptcha problem, not them and to talk to Google. Apparently though Google don't provide help unless you pay for it?? So I'm stuck. Can someone please point me in the right direction on how to fix this and stop the bot applications.

We host a number of servers for customers, sharing a public IP range. We have been having intermittent problems with customers receiving ReCAPTCHA challenges in a loop. They are presented with an endless stream of images and therefore can't reach the website they need. This problem is particularly frequent when using a particular piece of software which uses the CefSharp framework as an integrated web browser. We believe that our IP range has a poor reputation with ReCAPTCHA, perhaps due to the high volume of users sharing the IP range. Is there anything we can do about this?

Hello,We are using reCAPTCHA in company web application.However, since we are testing the application heavy, submitting similar data, we eventually get low score and cannot submit anymore.  Is there a effective way to whitelist user IP address or domain?Thanks in advance.

Hello team,I recently analyzed a targeted SMS registration attack against our mobile application and discovered something puzzling. Despite clear indicators of malicious behavior, Google reCAPTCHA v3 assigned these requests a relatively high score of 0.7 (with 1.0 being completely trusted human users).Attack Overview:Traffic originated from multiple hosting provider IPs across different continentsAll requests used identical app version but varied device modelsSystematic targeting of both registration and activation endpointsThe attack focused on specific activation code patternsThe Confusion: Why would reCAPTCHA v3 score these obvious automated attack requests from hosting servers as 0.7? Shouldn't this receive a very low score? Our threshold is set at 0.5, so these requests were considered "probably legitimate" by the system, just slightly suspicious.Discussion Questions:Is this a known limitation of the reCAPTCHA v3 algorithm?Has anyone experienced similar situations?Any recomme

We want to enable the silos service for our project. As we are trying to implement the Password check in the ReCAPTCHA Site key. Can any one help us to check the same whether the service could be enabled by the account administrator and have to contact the GCP support team.And how we can enable the password check in the Site Key.Thanks!

We provide support for 100+ websites built on different technology and we need to plan for migrating reCAPTCHA to enterprise version. In that situation we need some clarification on new Google reCAPTCHA policy.We are using one google account with associated billing information. Under one project we have a number of domains. Can anyone please reply to the following queries?Now if we have 10 domains with reCAPTCHA keys is it correct that the free quota of 10K assessments are applicable on the total assessments of 10 domains together and not 10K x 10?Is it possible to associate a separate billing details for each project?Is there any limit of domains to be added per project?Is there any limit for adding projects per account? how many?Is it possible to increase the limit if needed?Where do we see the number of assessments used in a month for a domain/project/account?If we have 10 domains under one project is it possible to have a report showing the usage status of each domain separately?Wh

I have integrated Google reCAPTCHA Enterprise score based solution. Everything is working fine as expected. I am able get scores from reCAPTCHA enterprise. Next I am planning to enhance to use MFA. As per the documentation, we need to complete email verification and before that I have completed "Ownership Verification" of my domain. In Google Search Console, i can see a message "You are a verified Owner". But when I am trying to enable Sender Name and Sender E-Mail, still I am getting "Your ownership of this domain could not be verified. Please verify your domain in the Google Search Console."For eg. assume i have verified my ownership for domain https://example.com. and I used support@example.com as my sender email. But not sure why i am getting an error message as mentioned after completing site ownership verification.What is missing here?

Hi there,We have been using ReCaptcha for a while now for the websites we create for our customers, and recently we have upgraded all keys to the new ReCaptcha enterprise.The "Protected Traffic" graph on the top of the page says there are 80,476 assessment requests in the past 30 days. We have about 150 recaptcha-keys, which would mean that in the past 30 days on avarage on every website 500+ calls were made.Is there a way to see how many recaptcha assessments per key were made, per day?I love the graphs for Google Maps API usage, but I would like to see where this 80K comes from. 

Description:Hello,I’m using reCAPTCHA Enterprise in my Android app. Everything works correctly when the app is installed directly from Android Studio or via a locally signed APK. However, when I distribute the app via Google Play Console (App Tester or internal testing), the reCAPTCHA flow fails with a “Site key invalid” error and shows an endless loading spinner.• The reCAPTCHA API is configured in Project B in Google Cloud.• The Android app is associated with Project A in Google Cloud.• The site key is configured with the correct package name, and the SHA-1 fingerprints (including the Google Play app signing certificate) have been added under API key restrictions.• Play Integrity API is not currently enabled in Project B where reCAPTCHA is configured.Questions:1. Can reCAPTCHA be used across different Google Cloud projects (i.e., app in Project A using reCAPTCHA from Project B)? I have a login module that is shared across multiple apps. 2. Why does it work when sideloaded but no

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

Hello everyone.We are operating a SaaS-based research platform where we collect data from customers through surveys and provide data analysis tools. In an effort to prevent bot responses on our survey response pages, we have integrated reCAPTCHA v3.Here is how we are currently using reCAPTCHA:1) When a user clicks the “Start Survey” button, we load the reCAPTCHA script to begin monitoring user behavior.2) When the user clicks the final “Submit Answer” button for the last question, we execute grecaptcha.execute() with the action name "submit" to retrieve a score.3) Based on the score, we assess whether the respondent may be a bot.However, we are currently facing some issues:1) Some legitimate users are receiving unexpectedly low scores.2) In contrast, automated scripts using Selenium are sometimes receiving high scores.We suspect that our current implementation may not be making the best use of action names or behavior signals. We would appreciate any guidance on how to improve the accu

Hello everyone, We use the free version of reCaptcha V2 on an e-commerce site. Do you know how to be notified in advance of changes made by Google? Recently, certificate changes made by Google made our site unavailable several days before we detected it. Indeed, on April 21, 2025, between 12:00 PM and 2:00 PM: Google made a change to its certificates (Root and Level 2). The certificates changed names and were in the Elliptic Curve algorithm rather than RSA. On May 2, 2025, Google reversed course and switched back to RSA. If we use an enterprise version, are we informed of changes planned by Google in advance ?, or do you know of another way to be informed in advance (linked to the announced changes?) Thanks in advance 

 We're currently using Recaptcha Enterprise (score based) on a site. We're consistently seeing low scores (including 0) for legitimate traffic. For requests with low scores, we'd like to present a fallback puzzle. Is there a way to do this using the Recaptcha Enterprise product? Recaptcha V2 Invisible seems ideal for us. However, our organization is large and so it's possible we'd have over 100k assessments in a month. Is it possible to use Recaptcha V2 at the Enterprise tier if we are over 100k assessments? I'm a little confused about how the Recaptcha Enterprise product is related to the Enterprise tier. My hope is we can use the Enterprise tier without the Enterprise product if the Enterprise product doesn't support what we need.Thanks!