WordPress CAPTCHA errors often arrive as vague complaints: "CAPTCHA expired," "site key missing," "verification failed," or "the form stopped working after an update." The cause is usually not WordPress itself. It is a plugin, theme, cache layer, consent banner, optimization setting, or key mismatch changing how the CAPTCHA script loads.
The fastest fix is not to swap plugins at random. Work through the stack in order: keys, domain, cache, script optimization, consent gating, plugin conflict, and backend verification. WordPress sites accumulate layers, and any one of them can break a challenge that worked last week.
Check the keys and domains first
Confirm the site key and secret key belong to the same provider, same CAPTCHA type, and same domain. A v2 checkbox key will not behave like a v3 score key. A production key may reject a staging domain. A www and non-www mismatch can also matter depending on provider configuration.
If the console says "site key missing" or "invalid site key," inspect the rendered page source. Sometimes a plugin setting is blank, a shortcode failed, or a page builder cached an old form. If the key appears twice, two plugins may both be trying to render CAPTCHA on the same form.
Clear cache and optimization layers
Object cache, page cache, CDN cache, JavaScript minification, defer settings, and delay-JS features can all break CAPTCHA timing. Clear caches after changing keys or plugin settings. Then test with JavaScript optimization disabled. If that fixes the form, re-enable optimization carefully and exclude the CAPTCHA provider script from delay or combine rules.
Consent banners are another common trap. If the banner blocks CAPTCHA scripts until consent, the form must not render as though verification is ready. Either load the security script under the correct legal basis for your jurisdiction or show a clear state that verification is waiting for consent.
Plugin conflict isolation
Temporarily switch to a default theme and disable nonessential plugins on staging. Test the form after each change. Pay attention to security plugins, form plugins, performance plugins, popup builders, and anything that changes login or checkout pages. If the CAPTCHA only fails on one form, compare that form's shortcode, block settings, and action hooks.
Better error handling
Do not show every backend issue as "CAPTCHA failed." Separate missing token, expired token, invalid site key, invalid domain, duplicate response, and provider fetch failure. Preserve user input when possible. WordPress users are often filling contact or quote forms; losing their text because a token expired is a conversion problem.
rCAPTCHA is useful for WordPress operators who want a cleaner view of verification behavior across forms and domains. If your current plugin makes every problem look the same, better logging is the first upgrade.
Related reading
- CAPTCHA verification failed: why verification fails and how to recover
- Invalid-input-response: debugging bad CAPTCHA tokens
- Cloudflare Turnstile vs Google reCAPTCHA
References
Try rCAPTCHA on your own site
Start with a minimal free testing plan, add a real site key, and see per-site verification data before moving to a paid tier.