reCAPTCHA Not Working on WordPress? Fixing "Invalid Domain", Key Type Errors and Forms That Won't Send

On this page

1. reCAPTCHA not working on WordPress: errors and what they mean
2. Fix "invalid domain for site key"
3. Fix "invalid key type": v2 vs v3
4. Forms that fail silently after a speed or plugin change
5. v3 blocking real visitors
6. When the form "works" but no email arrives
7. Is reCAPTCHA the right spam protection?
8. How to test a form properly
9. Getting forms fixed
10. Quick check: test the form like a visitor
11. When to get help
12. FAQs

If reCAPTCHA is not working on your WordPress site, the cause is usually the keys: your domain isn't listed in the reCAPTCHA admin console, the site key and secret key are swapped, or you have created v2 keys but your form plugin expects v3 (or the other way round). Fix those first, then check whether a caching or speed plugin is delaying the reCAPTCHA script, and whether two plugins are loading reCAPTCHA at the same time.

This guide goes through each error message and symptom, then explains how to test a form properly so you don't lose enquiries. A form that silently fails is worse than one that shows an error, because you won't know people tried to contact you.

reCAPTCHA not working on WordPress: errors and what they mean

Message or symptom	Meaning	Fix
"ERROR for site owner: Invalid domain for site key"	The domain isn't in the key's allowed list	Add the exact domain in the reCAPTCHA admin console
"Invalid key type"	v2 keys used for v3, or v3 keys for v2 checkbox	Create keys of the type your plugin expects
"Invalid site key"	Key copied wrongly or keys swapped	Re-paste site key and secret key in the correct fields
Form says "spam detected" or fails for real visitors	v3 score threshold too strict, or token expired	Lower the threshold, check page caching
Checkbox never appears	Script blocked, delayed or loaded twice	Exclude from delay, remove duplicate plugin
Form submits but no email arrives	Email delivery, not reCAPTCHA	Set up SMTP and check spam

Fix "invalid domain for site key"

Each reCAPTCHA key pair is tied to a list of domains. Open the Google reCAPTCHA admin console, choose your site and look at the Domains list. Add your domain without https:// or paths, for example example.com. Subdomains of a listed domain are generally covered, but a completely separate domain, a staging address or a temporary hosting URL is not, so add those separately or create separate keys for staging.

This error appears very often after a migration to a new host or a domain change, because the keys were created for the old address. Changes to the domain list can take a short while to apply.

Fix "invalid key type": v2 vs v3

Google offers different reCAPTCHA types, and keys from one don't work with another:

• v2 "I'm not a robot" checkbox: the visible tick box, sometimes followed by an image challenge.
• v2 Invisible: no checkbox, a challenge appears only when traffic looks suspicious.
• v3: no visible challenge at all; it scores each visit from 0.0 to 1.0 and your plugin decides what score to block.

Check which type your form plugin's settings mention, then create keys of exactly that type. Contact Form 7, for example, has used v3 in its built-in integration, while other form plugins let you choose. WordPress form plugins compared covers how the main plugins handle spam protection.

Google has also been moving reCAPTCHA keys into Google Cloud projects. If the console asks you to migrate keys, follow its steps; existing keys normally keep working, but check the current Google documentation for any changes to free usage limits.

Forms that fail silently after a speed or plugin change

If reCAPTCHA worked before and stopped after you installed or changed something, suspect these:

1. Delayed JavaScript. Speed plugins that delay scripts until user interaction can stop reCAPTCHA loading in time, so the form submits without a token and is rejected. Exclude recaptcha/api.js and your form plugin's scripts from delay.
2. Page caching with v3. v3 tokens expire after about two minutes. Most plugins request the token at submit time, but some generate it on page load; a visitor who takes longer to fill the form then fails. Updating the form plugin or switching to a submit-time setting usually fixes it.
3. Two plugins loading reCAPTCHA. A form plugin plus a security plugin plus a theme option can each add the script with different keys. Keep one and disable reCAPTCHA in the others.
4. Combined or minified scripts breaking the reCAPTCHA callback. Exclude them from combination.
5. Cookie consent tools that block Google scripts until Accept. If reCAPTCHA is blocked, the form can't be submitted at all, so classify it as necessary for the form or offer another contact method.

When several plugins are involved, the method in troubleshooting WordPress plugin conflicts helps you find the one causing trouble.

v3 blocking real visitors

With v3, your plugin compares each visitor's score with a threshold, commonly 0.5. Visitors on VPNs, privacy browsers, shared office networks or with JavaScript partly blocked can get low scores and be rejected as spam. If people tell you the form "doesn't work", or you see far fewer enquiries than expected, lower the threshold a little and watch spam levels for a week or two. The reCAPTCHA console shows the spread of scores your site receives, which helps choose a sensible value.

Always show a clear error message and an alternative, such as a phone number or WhatsApp button, so a blocked visitor can still reach you.

When the form "works" but no email arrives

A lot of reports of reCAPTCHA not working turn out to be email problems. If the form shows a success message but nothing reaches your inbox, reCAPTCHA has passed and the issue is delivery. Check spam, set up SMTP with your business email provider and configure SPF and DKIM. Saving form entries in the WordPress database as well means a missing email never loses an enquiry. Why your contact form isn't getting enquiries covers the wider checks.

If spam keeps arriving even with a working bot check, and your site is also sending emails you did not write, the form may not be the cause. See how we clean hacked WordPress sites.

Is reCAPTCHA the right spam protection?

reCAPTCHA is popular but not the only option, and it adds Google scripts to every page that shows a form. Some sites use alternatives such as Cloudflare Turnstile or simple honeypot fields, alone or together. A sensible layered approach looks like this:

Layer	What it stops	Effect on visitors
Honeypot field	Simple bots that fill every field	None
reCAPTCHA v3 or Turnstile	Most automated submissions	Usually invisible
Server-side validation	Junk phone numbers, links in messages	None for genuine entries
Rate limiting or firewall	Floods from one source	None

How to stop contact form spam on WordPress compares these methods. Loading reCAPTCHA only on pages with forms, rather than site-wide, also helps page speed.

How to test a form properly

After any fix, test as a real visitor would:

• Use a private window, logged out, on desktop and on a phone using mobile data.
• Wait a few minutes on the page before submitting, to catch token expiry.
• Confirm the success message, the email in your inbox and the saved entry.
• Repeat after clearing every cache layer.

It also helps to open the browser developer tools (right-click, Inspect, then the Console tab) while you submit. A red error mentioning recaptcha, grecaptcha or a blocked script tells you immediately whether the problem is the key, the script loading or something else on the page. The Network tab shows whether the form request was sent and what the server replied, which separates a reCAPTCHA rejection from an email or plugin failure. Take a screenshot of any error before you change settings, because it saves a lot of time if you later need a developer to look at it.

Make this part of a monthly check, because plugin updates can break forms without any visible error.

Getting forms fixed

If you have checked keys, scripts and email and the form still fails, a developer can look at browser console errors and server responses to find the exact point of failure. Form and spam fixes are part of WordPress maintenance and support, or you can hire a WordPress developer in India for a single fix.

Quick check: test the form like a visitor

1. Open the page with the form in a private window, fill it in and submit. Then press F12 and look at the Console for reCAPTCHA errors such as "Invalid domain for site key".
2. In the Google reCAPTCHA admin console, check that your domain is listed and that the key type (v2 or v3) matches what your form plugin expects.
3. Clear your caching plugin's cache, since a cached page can carry an expired token.

When to get help

Get help when genuine enquiries are being blocked, when spam still gets through, or when the form plugin and a security plugin both load reCAPTCHA. WordPress maintenance and support includes testing every form after changes. You can also hire a WordPress developer in India, or send the details through the contact form.

FAQs

Why is reCAPTCHA not working on my WordPress site?

The most common reasons are a domain missing from the key's settings, swapped or wrong-type keys, a speed plugin delaying the script, or two plugins loading reCAPTCHA at once. Check the error message, then the keys, then your plugins.

How do I fix "invalid domain for site key"?

Add your exact domain, without https or a path, to the Domains list for that key in the reCAPTCHA admin console. Staging or temporary domains need to be added separately.

Should I use reCAPTCHA v2 or v3?

v3 is invisible and easier on visitors but can block genuine people if the threshold is too strict. v2 checkbox is visible but predictable. Use whichever your form plugin supports best and combine it with a honeypot.

Can a caching plugin break reCAPTCHA?

Yes. Delaying or combining scripts can stop it loading, and cached pages can serve expired v3 tokens. Exclude reCAPTCHA and form scripts from delay and combination.

What if reCAPTCHA blocks real customers?

Lower the v3 score threshold slightly, show a clear error with another way to contact you, and check the score distribution in the reCAPTCHA console before tightening it again.