reCAPTCHA Is Blocking Real Visitors
Your spam protection is turning away genuine customers — puzzles that never complete, forms that reject everyone, or an error only your visitors ever see.
Common signs of this issue
- Visitors say the form won't submit, or they get stuck on a CAPTCHA that loops or never completes.
- A visible error like "ERROR for site owner: invalid site key" or "invalid domain for site key" appears near the form.
- The CAPTCHA box doesn't appear at all, but the form still refuses to send.
- Submissions dropped sharply right after adding or changing spam protection — the quiet version of the same problem.
- It fails mostly on phones, or for a specific slice of visitors (VPN users, certain browsers, overseas customers).
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Test as a stranger: open your form in a private/incognito window on a phone, and submit realistically. Note the exact error or behavior — CAPTCHAs treat the logged-in site owner more kindly than anyone else, so your normal browser is the least honest tester you have.
- If the error mentions "site owner" or "site key": that's a configuration failure, not a visitor problem — the keys are wrong, swapped, or registered for a different domain. Check that the CAPTCHA's registered domain matches your site exactly, including www vs non-www and any recent domain change.
- Verify the site key and secret key are each in the right field (they're frequently swapped) and belong to the same key pair and CAPTCHA version (v2 keys fail in v3 setups and vice versa).
- If you use invisible scoring protection (reCAPTCHA v3): find its score threshold in the form/plugin settings. Set strict (0.7+), it silently rejects a slice of real humans — phone users and VPN users score worst. Try a friendlier threshold (around 0.5) and watch a week.
- Check for doubled protection: a security plugin AND a form plugin each adding their own CAPTCHA breaks submission outright. One layer, deliberately chosen.
- Compare inquiry volume before/after the CAPTCHA arrived (form logs, email history). A drop is the protection eating real messages — the silent failure mode where nobody complains because nobody can.
- Ask any reporting customer two questions: what device, and what did the error say? One specific report usually identifies which slice of visitors is being rejected.
What this usually means
Blocking CAPTCHAs come in two flavors. Broken configuration — wrong/swapped keys, wrong registered domain, expired keys, stacked CAPTCHAs — fails everyone and announces itself with "site owner" errors: embarrassing, but fixable in minutes once seen. Over-strict tuning — high score thresholds, aggressive difficulty — silently rejects a percentage of real humans while working fine in your own tests: the more expensive flavor, because it looks like success.
The uncomfortable economics: spam costs you annoyance, but a blocked customer costs you the sale AND the relationship — and they don't report it, they leave. Protection should be tuned like a smoke detector: sensitive enough to catch fires, not so sensitive that cooking dinner triggers evacuation. When in doubt, err toward letting marginal messages through and deleting the spam that slips in.
Modern protection barely needs puzzles: invisible options (Cloudflare Turnstile, reCAPTCHA v3 at a sane threshold) plus a hidden honeypot field stop the overwhelming majority of bot spam with zero visitor effort. Visible click-the-crosswalks puzzles are increasingly a tax on your most legitimate, least patient visitors.
What not to do
- Don't remove all protection permanently in frustration — unprotected forms drown in bot spam within days, and the flood buries real messages just as effectively as blocking did.
- Don't dismiss a single "your form doesn't work" report because it works for you — CAPTCHA failures are selective by design; one report typically represents many silent exits.
- Don't stack two CAPTCHAs for 'extra safety' — they conflict, and broken-for-everyone is not extra safety.
- Don't paste your secret key into forums or screenshots when asking for help — site keys are public by nature; secret keys are not.
- Don't set-and-forget after fixing — put one live test submission (private window, phone) into your monthly routine; keys and thresholds break silently.
When to get help
If customers are being turned away at your front door, the fix is urgent and mercifully small: config errors resolve in minutes, and rebalancing to gentler protection (invisible verification plus honeypot, sane thresholds) is an hour of practiced work with a before/after you can measure in submissions. Worth doing properly once — a form that filters bots without filtering buyers is the actual goal, not maximum security theater.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
What does 'ERROR for site owner: invalid site key' mean?
The CAPTCHA's keys don't match this site — wrong keys, swapped site/secret keys, or keys registered to a different domain (www vs non-www counts). It fails every visitor until fixed, and the fix is re-checking the keys and registered domain — minutes, not hours.
How do I know if my CAPTCHA is blocking real people?
Two checks: test the form yourself in a private window on a phone (the least-trusted context you can easily create), and compare inquiry volume before vs after the protection was added. A post-CAPTCHA drop is real customers being eaten.
Why do phone and VPN users fail my CAPTCHA most?
Score-based protection rates visitors on signals like browsing history and network reputation — VPNs, private browsing, and some mobile networks score low and get rejected or endlessly puzzled. Lowering the threshold or switching to Turnstile usually rescues them.
What's the least annoying spam protection that still works?
An invisible checker (Cloudflare Turnstile or reCAPTCHA v3 with a moderate threshold) plus a hidden honeypot field. Together they stop the vast majority of bot spam with zero visitor friction — puzzles are rarely necessary for a small business form anymore.
reCAPTCHA v2 or v3 — what's the difference?
v2 is the visible checkbox/puzzle; v3 watches invisibly and scores each visitor 0–1, letting your form decide a cutoff. v3 is friendlier when tuned sanely (~0.5) and hostile when tuned strictly. Their keys aren't interchangeable — a version mismatch is itself a common breakage.
Can I protect my form without any CAPTCHA at all?
Often, yes: a honeypot (hidden field bots fill and humans never see) plus basic rate-limiting handles low-profile sites surprisingly well. If spam volume later grows, add an invisible checker. Start gentle; escalate only as reality demands.