How to fix WordPress CAPTCHA not working
If your WordPress CAPTCHA is not working, the problem usually comes from a plugin conflict, bad site configuration, blocked JavaScript, or an issue with the CAPTCHA provider.
The good news is that most failures can be isolated quickly with a few targeted checks.
This guide explains the most common causes behind broken CAPTCHA verification on WordPress and shows practical fixes for reCAPTCHA, hCaptcha, and similar tools.
Why WordPress CAPTCHA fails
CAPTCHA systems depend on several moving parts: the form plugin, the CAPTCHA plugin or integration, browser-side JavaScript, server-side validation, and the external service such as Google reCAPTCHA or hCaptcha.
If any one of those layers breaks, users may see a missing checkbox, endless loading, or a form that submits without validation.
Common symptoms include a CAPTCHA widget that does not load, an error such as invalid site key or secret key, a verification token that expires too quickly, or a form that rejects submissions even when the CAPTCHA appears correct.
Check the CAPTCHA keys first
Incorrect site keys and secret keys are one of the most common causes of a CAPTCHA failure.
Revisit the provider dashboard and confirm that the keys match the exact domain and CAPTCHA type configured in WordPress.
- Verify that the site key and secret key were copied without extra spaces.
- Confirm you selected the correct CAPTCHA version, such as reCAPTCHA v2, v3, or hCaptcha.
- Check that the domain listed in the provider console matches the live site URL.
- If you recently changed domains, regenerate the keys for the new domain.
For staging environments, many CAPTCHA services require separate keys or explicit approval for additional hostnames.
Confirm the plugin integration
WordPress CAPTCHA issues often come from a mismatch between the CAPTCHA plugin and the form plugin.
Contact Form 7, WPForms, Gravity Forms, WooCommerce checkout extensions, and custom login forms may each use different integration methods.
Review the plugin settings and make sure CAPTCHA is enabled for the correct form.
If you installed a standalone CAPTCHA plugin, confirm that it supports the form builder you are using.
Some plugins only protect login pages, while others only work on contact forms or comments.
Test with only the required plugin active
Temporarily deactivate nonessential plugins and leave only the form plugin and CAPTCHA plugin active.
Then test the form again.
If CAPTCHA starts working, re-enable plugins one by one to identify the conflict.
Look for JavaScript errors
Most modern CAPTCHA solutions rely on JavaScript to render the widget and exchange verification tokens.
If scripts are blocked or delayed, the CAPTCHA may appear blank or fail silently.
Open your browser developer tools and check the Console tab for errors related to reCAPTCHA, hCaptcha, jQuery, or blocked resources.
Typical causes include:
- JavaScript minification or optimization plugins delaying required scripts
- Browser privacy extensions blocking third-party CAPTCHA assets
- Theme code removing or altering script hooks
- Mixed-content warnings when HTTPS and HTTP assets are combined
If you use a performance plugin such as WP Rocket, LiteSpeed Cache, Autoptimize, or similar tools, exclude CAPTCHA scripts from defer, delay, combine, or minify settings.
Check for theme conflicts
A poorly coded theme can interfere with form markup, script loading, or inline styles.
Switch temporarily to a default WordPress theme such as Twenty Twenty-Four and retest the CAPTCHA.
If the CAPTCHA works with the default theme, your active theme likely contains a conflict.
Common theme-level issues include duplicated form code, stripped scripts, or page template overrides that break plugin output.
Make sure HTTPS is configured correctly
Most CAPTCHA providers expect a secure site.
If your WordPress site loads over HTTPS but some page elements still reference HTTP, CAPTCHA validation may fail or fail to render at all.
- Confirm that WordPress Address and Site Address both use HTTPS.
- Replace mixed-content assets in the database or theme files.
- Make sure the SSL certificate is valid and not expired.
- Force secure admin and login pages if your host supports it.
Use a browser security audit or online SSL checker to confirm there are no certificate errors or redirect loops.
Review firewall, CDN, and bot protection settings
Cloudflare, Sucuri, Wordfence, and other security tools can block CAPTCHA assets or challenge page visitors before the CAPTCHA script loads.
Some CDNs also cache pages in a way that prevents dynamic verification from working properly.
Inspect firewall logs for blocked requests to Google or hCaptcha endpoints.
If you use Cloudflare, check features such as Bot Fight Mode, JavaScript challenges, and aggressive caching rules.
For Wordfence or similar plugins, whitelist the CAPTCHA provider’s script and API endpoints if needed.
Fix cache and cookie problems
CAPTCHA verification can fail when cached pages serve stale tokens or when cookies are blocked.
Clear all layers of cache, including:
- WordPress caching plugins
- Server-side cache
- CDN cache
- Browser cache
After clearing cache, test in a private browser window and, if possible, in a different browser.
If the CAPTCHA works only after a hard refresh, caching rules may be interfering with the form output.
Verify the CAPTCHA provider status
Sometimes the problem is outside WordPress.
Google reCAPTCHA, hCaptcha, and other services may experience outages, degraded performance, or regional blocking.
If the widget is missing or verification requests time out, check the provider status page and recent incident reports.
When provider availability is unstable, consider temporarily switching to a different CAPTCHA solution or using a fallback anti-spam tool such as honeypot protection.
Inspect form submit behavior
Some forms look protected by CAPTCHA but submit before verification completes.
This often happens when custom JavaScript overrides the default submit action or when AJAX forms are not configured correctly.
Check whether the form uses standard POST submission or AJAX.
If the form builder has a separate setting for reCAPTCHA or hCaptcha in AJAX mode, enable it.
For custom forms, ensure the verification token is sent with the request and validated on the server side.
Update WordPress core, plugins, and PHP
Outdated software can create compatibility issues with current CAPTCHA APIs.
Update WordPress core, the active theme, the form plugin, and the CAPTCHA plugin.
Also confirm that your hosting account uses a supported PHP version.
Plugin developers frequently adjust CAPTCHA integrations when Google, hCaptcha, or browser behavior changes.
Keeping your stack current reduces the chance of breakage and improves security.
Use browser and server logs to isolate the issue
When the cause is not obvious, logs are your best diagnostic tool.
Browser console output can show frontend script failures, while server logs can reveal PHP errors, blocked requests, or failed validation calls.
- Check PHP error logs for fatal errors or warnings in the form plugin
- Review web server logs for 403, 404, or 5xx responses on CAPTCHA endpoints
- Use the Network tab to see whether external CAPTCHA requests complete successfully
If the CAPTCHA loads but submissions fail, the server may be rejecting the verification token due to timeouts, missing headers, or incorrect secret key validation.
When to replace the CAPTCHA solution
If you have ruled out configuration problems, conflicts, caching, and provider issues, the current CAPTCHA tool may simply be incompatible with your stack.
This happens more often on heavily optimized sites, custom membership portals, and multilingual installations.
In that case, consider switching to a different anti-spam method that better matches your forms and audience.
Options include hCaptcha, Cloudflare Turnstile, honeypot fields, and dedicated anti-spam plugins that do not depend on visible challenge widgets.
Quick checklist to diagnose the problem
- Confirm the site key, secret key, and domain match the provider dashboard
- Test with only the form plugin and CAPTCHA plugin active
- Disable script optimization for CAPTCHA assets
- Check browser console errors and network requests
- Clear all caches and retest in a private window
- Verify HTTPS, SSL, and mixed-content settings
- Review security plugin, firewall, and CDN rules
- Update WordPress, plugins, theme, and PHP
By moving through these checks in order, you can usually identify why WordPress CAPTCHA is not working and restore form protection without guessing.