reCAPTCHA v3 in Wordfence Blocks Login – “CAPTCHA EXPIRED”

(@piotrek92)

Hello WordPress Community,

I am experiencing issues with reCAPTCHA v3 in Wordfence Login Security, where multiple users are unable to log in due to the error “CAPTCHA EXPIRED” or getting locked out. This issue occurs across multiple browsers, but is particularly problematic in Safari (both macOS and iOS, especially in Private Mode). Below, I outline the problem, the steps taken so far, and my system details.

Issue Description:

• reCAPTCHA v3 is enabled in Wordfence Login Security to prevent bot logins.

• Users across different browsers (Safari, Firefox, and sometimes Edge) experience “CAPTCHA EXPIRED” when trying to log in.

• Safari users in Private Mode are the most affected, but even in normal browsing mode, the issue is inconsistent.

• The problem does not always occur in Chrome, though some users have reported intermittent failures.

• Disabling reCAPTCHA v3 in Wordfence allows users to log in without issues, confirming that reCAPTCHA is the source of the problem.

Steps Taken to Troubleshoot:

1. Checked Plugin and WordPress Versions:

• WordPress, Wordfence, and all plugins are updated to the latest versions.

• PHP version: 8.0

• MySQL version: 5.7

• No errors in the WordPress debug log.

2. Confirmed Caching is Not Causing Conflicts:

• W3 Total Cache settings checked – login page and wp-login.php are excluded from caching.

• Object Cache and Database Cache are disabled.

• Minify settings adjusted to exclude recaptcha/api.js to ensure it loads properly.

3. Investigated Browser-Specific Issues:

• The issue occurs most frequently in Safari (especially in Private Mode) but has also been reported in Firefox and Edge.

• In Safari, toggling “Prevent Cross-Site Tracking” temporarily fixes the issue, but requiring users to change their browser settings is not ideal.

• Clearing cache and cookies in all affected browsers did not resolve the issue.

• Confirmed that the reCAPTCHA v3 badge appears in the bottom corner, meaning the script is loading properly.

4. Tried Adjusting reCAPTCHA Settings in Wordfence:

• Lowered the reCAPTCHA v3 threshold to make it less sensitive to low scores.

• Tested in Test Mode to log reCAPTCHA scores—affected users often receive very low scores (0.0 - 0.1), which may trigger login restrictions.

• No issues with reCAPTCHA key or secret—no invalid key errors in Wordfence logs.

Questions:

1. Why is reCAPTCHA v3 failing or expiring across multiple browsers, particularly in Safari, Firefox, and Edge?

2. Is there a way to configure Wordfence reCAPTCHA v3 to work properly in Safari Private Mode and prevent other browsers from being affected?

3. Are there known conflicts between Wordfence reCAPTCHA and privacy-focused browser settings (e.g., cross-site tracking prevention, cookie handling)?

4. Would switching to reCAPTCHA v2 (checkbox) or an alternative like Cloudflare Turnstile improve compatibility?

5. Are there specific server or security headers that could be adjusted to prevent browsers from blocking reCAPTCHA verification?

I would appreciate any guidance on resolving this issue. Let me know if you need additional details.

Thanks in advance for your help!

Viewing 3 replies - 1 through 3 (of 3 total)

potorot
(@potorot)

9 months, 1 week ago

Yes, many of us experience this… there’s no solution for now… turn off recaptcha!

Plugin Support wfpeter
(@wfpeter)

9 months, 1 week ago

Hi @piotrek92,

Thank you providing so much detail, although “CAPTCHA EXPIRED” and getting locked out are two different issues. It is somewhat normal to see more reCAPTCHA failures (not “expired” messages) when using private/incognito modes, because Google has less information about the visitor to verify whether they’re a bot or not.

There was a W3TC release that tries to disable the object cache on February 24, and CAPTCHA issues started occurring for some customers on February 25 onwards.

So we can confirm if that might be the case for you too, please visit Wordfence > Tools > Diagnostics page. You can send the output to us at wftest @ wordfence . com. Click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Many thanks,
Peter.

Thread Starter piotrek92
(@piotrek92)

9 months, 1 week ago

First of all, I would like to thank you very much for your quick response and support – I really appreciate it!

To clarify, using incognito mode was not the cause of the issue but rather a consequence of my troubleshooting. Initially, users were unable to log in under normal conditions due to reCAPTCHA. When I started investigating, I tested different browsers and modes, and that’s when I noticed that the issue was more persistent in Safari (especially Private Mode), but it also affected other browsers like Firefox and Edge.

I also realize that I may have phrased my initial post imprecisely. The login blockage was not due to a direct “lockout” but rather because users could not pass the CAPTCHA verification. The only way to log in was to disable Wordfence temporarily.

I have now sent the diagnostic report via Wordfence > Tools > Diagnostics, as requested. Please let me know if any further details are needed.

Again, thank you so much for your help! I really appreciate your time and assistance.

Best regards,
Piotrek

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘reCAPTCHA v3 in Wordfence Blocks Login – “CAPTCHA EXPIRED”’ is closed to new replies.

Tags