reCAPTCHA

I'm getting the following message.Finish setting up your key: Request tokens To protect your site or app, finish setting up your key. Start by requesting tokens (executes).My website is a Wordpress Site and I'm using the plugin WP Forms.  I have others I setup the same way and they say protected and I didn't have to request tokens.  what am I missing?

Hi, I've installed Recaptcha 3 on a Wordpress site that uses Job Manager. I've put the Recaptcha key into Job Manager and Recaptcha is confirming that it's set up correctly. But there is a bot that is repeatedly sending job applications in via the Job Manager form, and is not getting stopped by Recaptcha. I've tried fully deleting the job that the bot is attacking, but it just jumps to another one.The Job Manager developers have said it's a Recaptcha problem, not them and to talk to Google. Apparently though Google don't provide help unless you pay for it?? So I'm stuck. Can someone please point me in the right direction on how to fix this and stop the bot applications.

We host a number of servers for customers, sharing a public IP range. We have been having intermittent problems with customers receiving ReCAPTCHA challenges in a loop. They are presented with an endless stream of images and therefore can't reach the website they need. This problem is particularly frequent when using a particular piece of software which uses the CefSharp framework as an integrated web browser. We believe that our IP range has a poor reputation with ReCAPTCHA, perhaps due to the high volume of users sharing the IP range. Is there anything we can do about this?

Hello,We are using reCAPTCHA in company web application.However, since we are testing the application heavy, submitting similar data, we eventually get low score and cannot submit anymore.  Is there a effective way to whitelist user IP address or domain?Thanks in advance.

Hello team,I recently analyzed a targeted SMS registration attack against our mobile application and discovered something puzzling. Despite clear indicators of malicious behavior, Google reCAPTCHA v3 assigned these requests a relatively high score of 0.7 (with 1.0 being completely trusted human users).Attack Overview:Traffic originated from multiple hosting provider IPs across different continentsAll requests used identical app version but varied device modelsSystematic targeting of both registration and activation endpointsThe attack focused on specific activation code patternsThe Confusion: Why would reCAPTCHA v3 score these obvious automated attack requests from hosting servers as 0.7? Shouldn't this receive a very low score? Our threshold is set at 0.5, so these requests were considered "probably legitimate" by the system, just slightly suspicious.

We want to enable the silos service for our project. As we are trying to implement the Password check in the ReCAPTCHA Site key. Can any one help us to check the same whether the service could be enabled by the account administrator and have to contact the GCP support team.And how we can enable the password check in the Site Key.Thanks!

We provide support for 100+ websites built on different technology and we need to plan for migrating reCAPTCHA to enterprise version. In that situation we need some clarification on new Google reCAPTCHA policy.We are using one google account with associated billing information. Under one project we have a number of domains. Can anyone please reply to the following queries?Now if we have 10 domains with reCAPTCHA keys is it correct that the free quota of 10K assessments are applicable on the total assessments of 10 domains together and not 10K x 10?Is it possible to associate a separate billing details for each project?Is there any limit of domains to be added per project?Is there any limit for adding projects per account? how many?Is it possible to increase the limit if needed?Where do we see the number

I have integrated Google reCAPTCHA Enterprise score based solution. Everything is working fine as expected. I am able get scores from reCAPTCHA enterprise. Next I am planning to enhance to use MFA. As per the documentation, we need to complete email verification and before that I have completed "Ownership Verification" of my domain. In Google Search Console, i can see a message "You are a verified Owner". But when I am trying to enable Sender Name and Sender E-Mail, still I am getting "Your ownership of this domain could not be verified. Please verify your domain in the Google Search Console."For eg. assume i have verified my ownership for domain https://example.com. and I used support@example.com as my sender email. But not sure why i am getting an error message as mentioned after completing site ownership verification.Wh

Hi there,We have been using ReCaptcha for a while now for the websites we create for our customers, and recently we have upgraded all keys to the new ReCaptcha enterprise.The "Protected Traffic" graph on the top of the page says there are 80,476 assessment requests in the past 30 days. We have about 150 recaptcha-keys, which would mean that in the past 30 days on avarage on every website 500+ calls were made.Is there a way to see how many recaptcha assessments per key were made, per day?I love the graphs for Google Maps API usage, but I would like to see where this 80K comes from. 

Description:Hello,I’m using reCAPTCHA Enterprise in my Android app. Everything works correctly when the app is installed directly from Android Studio or via a locally signed APK. However, when I distribute the app via Google Play Console (App Tester or internal testing), the reCAPTCHA flow fails with a “Site key invalid” error and shows an endless loading spinner.• The reCAPTCHA API is configured in Project B in Google Cloud.• The Android app is associated with Project A in Google Cloud.• The site key is configured with the correct package name, and the SHA-1 fingerprints (including the Google Play app signing certificate) have been added under API key restrictions.• Play Integrity API is not currently enabled in Project B where reCAPTCHA is configured.Questions:1. Can reCAPTCHA be used across different Google Cloud projects (i.e., app in Project A using reCAPTCHA from Project B)? I have a login module that is shared across mult

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

Hello everyone.We are operating a SaaS-based research platform where we collect data from customers through surveys and provide data analysis tools. In an effort to prevent bot responses on our survey response pages, we have integrated reCAPTCHA v3.Here is how we are currently using reCAPTCHA:1) When a user clicks the “Start Survey” button, we load the reCAPTCHA script to begin monitoring user behavior.2) When the user clicks the final “Submit Answer” button for the last question, we execute grecaptcha.execute() with the action name "submit" to retrieve a score.3) Based on the score, we assess whether the respondent may be a bot.However, we are currently facing some issues:1) Some legitimate users are receiving unexpectedly low scores.2) In contrast, automated scripts using Selenium are sometimes receiving high scores.We suspect tha

Hello everyone, We use the free version of reCaptcha V2 on an e-commerce site. Do you know how to be notified in advance of changes made by Google? Recently, certificate changes made by Google made our site unavailable several days before we detected it. Indeed, on April 21, 2025, between 12:00 PM and 2:00 PM: Google made a change to its certificates (Root and Level 2). The certificates changed names and were in the Elliptic Curve algorithm rather than RSA. On May 2, 2025, Google reversed course and switched back to RSA. If we use an enterprise version, are we informed of changes planned by Google in advance ?, or do you know of another way to be informed in advance (linked to the announced changes?) Thanks in advance 

 We're currently using Recaptcha Enterprise (score based) on a site. We're consistently seeing low scores (including 0) for legitimate traffic. For requests with low scores, we'd like to present a fallback puzzle. Is there a way to do this using the Recaptcha Enterprise product? Recaptcha V2 Invisible seems ideal for us. However, our organization is large and so it's possible we'd have over 100k assessments in a month. Is it possible to use Recaptcha V2 at the Enterprise tier if we are over 100k assessments? I'm a little confused about how the Recaptcha Enterprise product is related to the Enterprise tier. My hope is we can use the Enterprise tier without the Enterprise product if the Enterprise product doesn't support what we need.Thanks!

Hello, I hope you can assist me with a question regarding reCAPTCHA billing. I've reviewed the following documentation: reCAPTCHA Billing Information reCAPTCHA Pricing My question is about what happens when the free tier of 10,000 assessments combined is reached. Do I then need to pay $8 for each of my reCAPTCHA keys? Furthermore, does the 100,000 assessment limit apply individually to each reCAPTCHA key? For example, if I have two keys, would I have a limit of 100,000 assessments per key, totaling 200,000 assessments across both? Thank you for your time and clarification. Best regards, Martin

Hi Team,I'm currently implementing reCAPTCHA Enterprise on a web page within my application and have encountered an issue where the validation seems to expire after just 1 minute, rather than the expected 2-minute validity period as stated in Google's documentation.Here's how the flow works:A user interacts with the reCAPTCHA checkbox on the page.Once checked, my application calls an internal Web API.This API then sends a Captcha Verification Request and successfully returns a valid score.However, despite a successful verification, the validation expires right after 1 minute, and gives me a message "Validation failed, please try again"  — even though no additional action or reset is performed on the token.To troubleshoot:I reviewed Google's documentation and found the expected validity is 2 minutes.I removed all other JavaScript from the page to rule out script conflicts.I verified that there are no manual re

Hello everyone,I've followed the migration guide provided by google to migrate the recaptcha key to google cloud console.Everything appears to be setup correctly but there are a couple of things that I don't fully understand:1.- The Security > reCAPTCHA page shows a number of assesment request, currently 44. Is that the number that shouldn't go above 10.000 for free reCAPTCHA usage?2.- When I go to the specific migrated key I see this:My websites are using certain wordpress plugins that can only use recaptcha with site and secret keys, do I require some other modifications to this to work?I thought everything would be working they way it was and this was just a migration to google cloud console.Als

It’s an error popping up saying my account got phished and it says ERROR for site owner: Invalid site keyfor recaptcha so I need to talk an agent live chat about this issue being resolved 

Hello, we recieved an email saying that we will need to change the recaptcha and create a google cloud project for it to keep working. The email said that in the last 3 months my recaptcha average 327 assesments, but when I go to the recaptcha admin page I see 98,000 requests for the last 90 days.How does the pricing work for this? Does it charge when you reach X amount of requests or X amount of assesments? In this case assesments and requests are the same? If not what's the difference?Kind regards,  

I think reCAPTCHA has a bug for meim Trying to log into steam and I forgot my username, so I type my email and click I’m not a robot. It gives me what feels like thousands of prompts and then it tells me I’m a robot. I’m just trying to play my video games, I’m not a robot.

Hi,We are building a form service similar to Google Forms, where users can create custom forms and embed them into their websites via <iframe>.We’re currently implementing reCAPTCHA v3 to protect these embedded forms. Using the default implementation, the reCAPTCHA badge at the bottom left is as expected. We’d like better to localize the UI for Japanese users and our service.Current:What we’re trying to achieve We want to:1. Display the attribution text in Japanese, e.g.:```<div>  <img src="https://www.gstatic.com/recaptcha/api2/logo_48.png">  <div>

Hi everyone,I've been using Google reCAPTCHA v3 (enterprise) on my site for a while now, and until recently, everything was working fine. The token generated by recaptchased to be around 2k characters long, which I understand is normal for v3.However, starting four days ago, every token returned is consistently around 12,000 characters — and this happens on every single request. Nothing has changed on my end in terms of implementation.Has anyone else experienced something similar lately? Could this be related to a recent change on Google's end, or is there something obscure I might be missing?Thanks in advance for any help or insight!

Hello Sir/madam I got this email that Google reCAPTCHA keys will need to be migrated to a Google Cloud project by the end of 2025. Assuming I forget to do the migration, will the recaptcha come to a grinding halt on my webpage?Thank you Karvesh

Hello, everyone!I am developing a website and would like to integrate reCaptcha into it. The FAQ states: "You are allowed to hide the badge as long as you include the reCAPTCHA branding visibly in the user flow. Please include the following text...".What exactly user flow means? Does it mean to include everywhere links for privacy and policy where I'm using it. I have Footer component which is visible everywhere, on all pages. There I have link to Terms of use for my web-app. Will it be enough for my page to state: "This site is protected by reCAPTCHA and the Google<a href="https://policies.google.com/privacy">Privacy Policy</a> and<a href="https://policies.google.com/terms">Terms of Service</a> apply." The link to this page is accessible from any page.

Hello, I am having a problem with reCAPTCHA v2 and v3. It seems that on all the websites where we have it installed, it has stopped working. I have tried all possible methods from reCAPTCHA tutorials, and I switched to version 2 to see if that would fix it.The error that is returned is browser_error, and it seems to always be the same. This error causes the form to be blocked, and it is not possible to submit it. Or, if I change the way the captcha is implemented and it allows submission, the token is invalid and it's not possible to complete the process.Why am I almost always getting an invalid token?Sometimes it works in Chrome, but in other browsers, it doesn't.