reCAPTCHA and Cloudflare Turnstile both verify a visitor isn’t a bot before allowing form submission, and when either shows an error, fails to load, or blocks legitimate visitors, the cause is almost always a mismatch between the keys configured on your site and what’s registered with the service, or a conflict with caching.
Check the browser console for the specific error when the widget fails
Open your browser’s developer console (F12 or Cmd+Option+I) and reload the page with the form. An error specifically referencing reCAPTCHA or Turnstile, often mentioning a key or domain mismatch, tells us exactly what’s misconfigured rather than guessing from a general “it’s not working” description.
reCAPTCHA / Turnstile setup & errors
reCAPTCHA or Turnstile failing to load or blocking real visitors — the key or domain mismatch found.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
This or something else?
| reCAPTCHA or Turnstile is showing an error, failing to load, or blocking legitimate visitors | This fix covers it |
| You want spam protection set up for the first time and haven’t chosen a method yet | Form spam flood – anti-spam configuration, the broader setup version |
| The widget works but spam is still getting through anyway | Worth describing the specific pattern — may indicate a configuration or threshold issue rather than the widget itself failing |
| The error is specifically about API rate limits from the service itself | API rate limit & timeout handling, a related but distinct issue |
What you are seeing
- An error message where the reCAPTCHA or Turnstile widget should appear
- The widget failing to load entirely, leaving the form unsubmittable
- Legitimate visitors being blocked or challenged excessively
- The issue possibly appearing only after a domain change or SSL migration
Common causes
- Site keys configured for a different domain than the one currently in use
- A caching plugin serving a stale version of the page with outdated or missing keys
- A conflict between the reCAPTCHA/Turnstile script and another script on the page
- The service’s own account settings not correctly reflecting your current domain after a migration
- A Content Security Policy header blocking the widget’s script from loading at all
What we do
- Confirm the exact error and reproduce it
- Verify the site keys match what’s registered for your current domain in the service’s own dashboard
- Check for caching or script conflicts interfering with the widget
- Correct the configuration or resolve the conflict identified
- Test form submission end to end to confirm it completes correctly
- Verify legitimate visitors aren’t being excessively challenged after the fix
What is included
- The specific cause of the reCAPTCHA or Turnstile error identified and corrected
- Verified working form submission end to end
- A check that legitimate visitors aren’t excessively challenged
- The pre-fix backup, kept for 30 days
Not included
- Changes to your account settings within Google’s or Cloudflare’s own dashboard beyond what’s needed to fix this specific error — we configure the integration, we don’t manage the underlying service account for you
- Setting up a different spam protection method entirely, a separate, related fix if you’d rather switch approaches
- API rate limit issues from the service itself, a separate, related fix
- Ongoing monitoring for future service-side changes
Questions about this fix
Why would this break after a domain or SSL change if nothing about the form itself changed?
reCAPTCHA and Turnstile both tie their site keys to specific, registered domains — a domain change means the keys need updating to match, even though the form's own configuration hasn't changed at all.
Is this something Google or Cloudflare broke, or something on my site?
It's usually a mismatch between the two — the keys on your site not matching what's registered on the service's side — which we can fix on your site's end, though if the service itself is having a genuine outage, that's outside anyone's ability to fix from your side.
Will fixing this affect how strict the bot-checking actually is?
Not unless you specifically want that adjusted — we're fixing the error preventing it from working correctly, not changing its underlying sensitivity, though we can discuss adjusting that separately if it's overly strict.
What if my account with the service itself has an issue, not just my site's configuration?
We'd identify that distinction during diagnosis — if it's genuinely an account-level issue on Google's or Cloudflare's side, that's something you'd need to resolve directly with them, since we don't manage your account on your behalf.
Could a caching plugin really be the cause of something like this?
Yes, surprisingly often — if a page is cached with an outdated key or before a configuration change, visitors can keep hitting the stale, broken version until the cache is properly cleared and reconfigured to handle this correctly.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.