If reCAPTCHA is blocking WordPress login, the issue is usually tied to configuration, caching, script loading, or plugin conflicts.
This guide explains how to fix reCAPTCHA error on WordPress login and narrow down the exact cause without guesswork.
Why reCAPTCHA fails on the WordPress login page
Google reCAPTCHA depends on a valid site key, secret key, and correct domain setup.
When any part of that chain breaks, the login form may show errors such as “Invalid domain for site key”, “ERROR for site owner”, or a checkbox or badge that never loads.
On WordPress, the most common triggers include security plugins, optimization tools, theme conflicts, and mismatched reCAPTCHA versions.
Because the login page is often handled differently from public pages, a setting that works elsewhere can still fail on /wp-login.php.
Check whether the error is from Google or WordPress
Before changing settings, identify where the failure starts.
A browser console error points to script loading, while a message on the form usually points to an invalid key or token verification problem.
- Google error message: The keys, domain, or reCAPTCHA version may be wrong.
- WordPress login failure: The plugin may be rejecting the login after verification.
- Blank widget or missing badge: JavaScript, caching, or ad-blocking may be interfering.
If possible, test the login page in an incognito window and inspect the browser console with Developer Tools.
This helps separate a site-wide bug from a browser-specific issue.
Verify your reCAPTCHA site key and secret key
The most direct fix for how to fix reCAPTCHA error on WordPress login is confirming that the credentials match the reCAPTCHA type you created in the Google reCAPTCHA admin console.
A v2 checkbox key will not work with a v3 configuration, and enterprise keys follow different implementation rules.
- Open your WordPress reCAPTCHA plugin settings.
- Compare the site key and secret key with the values in your Google reCAPTCHA console.
- Confirm that the selected type matches the plugin setting: v2 checkbox, v2 invisible, or v3.
- Save changes and clear all caches.
Many login errors happen after copying keys from a staging site or from another domain.
Even a single character error can break verification.
Confirm the domain is added correctly
Google validates the domain where reCAPTCHA is used.
If your site uses www but the key was registered for the non-www version, or if you recently moved from HTTP to HTTPS, reCAPTCHA can fail.
Check the following:
- The exact domain in the Google reCAPTCHA console matches your live site.
- Both
example.comandwww.example.comare covered if your site uses both. - Your staging or development domain is not being used on production.
- There are no mismatches between the WordPress Address and Site Address settings.
If you changed domains, create a fresh reCAPTCHA configuration for the current domain instead of reusing old keys.
Match the reCAPTCHA version to your plugin
WordPress plugins usually support only certain reCAPTCHA versions.
For example, some login protection plugins support v2 checkbox, while others use v3 score-based verification.
If the plugin expects one version and the Google console was set up for another, login will fail.
Common signs of a version mismatch include:
- The widget appears but login still fails.
- The badge loads, but the form says verification failed.
- The plugin settings mention a version different from the one you created in Google.
To resolve this, check the plugin documentation and confirm compatibility before adjusting anything else.
Disable caching and minification on the login page
Performance plugins such as WP Rocket, LiteSpeed Cache, Autoptimize, and Cloudflare can delay or alter the JavaScript reCAPTCHA needs.
If scripts are deferred, combined, or minified incorrectly, the login form may stop verifying tokens.
Exclude these pages and assets from optimization:
/wp-login.php/wp-admin/- Google reCAPTCHA scripts from
google.comandgstatic.com
Also clear server cache, browser cache, and any CDN cache after changing settings.
If Cloudflare is active, temporarily disable Rocket Loader or script optimization to test whether it is the cause.
Test for plugin conflicts
Security and login plugins can overlap.
Two different plugins trying to protect the same login form may cause reCAPTCHA to reject submissions or prevent the script from loading properly.
To isolate a conflict, disable all nonessential plugins except the reCAPTCHA plugin and then test the login page.
If the error disappears, reactivate plugins one by one until the conflict returns.
Plugins that commonly affect login behavior include:
- Wordfence
- iThemes Security
- All In One WP Security
- LoginPress
- WooCommerce-related security extensions
If a conflict appears, check whether the plugin has its own built-in CAPTCHA or login protection feature and avoid running two overlapping solutions at once.
Check the theme and custom login code
Some WordPress sites use customized login pages, child themes, or code snippets that alter the standard login process.
A missing wp_footer() call, a broken hook, or a template override can stop reCAPTCHA assets from loading.
If the login page uses a custom template, verify that it still includes the necessary WordPress hooks and that no JavaScript errors are breaking form submission.
Switching temporarily to a default theme such as Twenty Twenty-Four can help determine whether the theme is involved.
Review browser and server-side errors
When the page loads but verification still fails, inspect both the browser and server logs.
Browser console errors often reveal blocked network requests, CSP restrictions, or JavaScript syntax issues.
Server logs can show failed token verification or timeout problems.
Look for these patterns:
- Content Security Policy blocks: Google script domains are not allowed.
- Mixed content: HTTPS page loads an HTTP asset.
- cURL or firewall issues: The server cannot contact Google to verify tokens.
- 403 or 429 responses: Rate limiting or security rules are blocking the request.
If your host uses a web application firewall, ask whether it is filtering requests to reCAPTCHA endpoints.
Use the correct keys for localhost or staging
Development environments often behave differently from production.
Google reCAPTCHA is stricter about domain matching in local and staging setups, and some plugins do not support localhost testing cleanly.
If you are testing on a nonpublic environment, check whether the plugin supports that setup.
For local development, you may need to use dedicated staging keys or temporarily disable reCAPTCHA until you move to a live domain.
Recreate the reCAPTCHA configuration if needed
If every setting appears correct but the login error continues, recreate the integration from scratch.
This is often faster than trying to patch a broken configuration.
- Delete the existing reCAPTCHA keys from the plugin.
- Remove the site from the Google reCAPTCHA console if necessary.
- Create a new reCAPTCHA entry for the correct domain and version.
- Paste the fresh keys into WordPress.
- Clear all caches and retest the login page.
This approach is especially helpful after a migration, domain change, plugin swap, or SSL renewal.
Prevent reCAPTCHA login problems in the future
Once the login works again, a few maintenance habits can reduce repeat issues.
Keep your reCAPTCHA plugin, WordPress core, theme, and security tools updated.
Document the key version, domain, and plugin name used for the setup so future migrations are easier.
- Use only one login protection plugin at a time.
- Exclude login scripts from optimization and caching.
- Match the reCAPTCHA version to the plugin documentation.
- Recheck keys after domain, SSL, or CDN changes.
- Monitor console errors after major updates.
These steps are especially important for sites with WooCommerce, membership logins, or custom authentication flows, because those setups tend to use more scripts and security layers than a standard WordPress install.