Hi @dave22n, thanks for getting in touch.
If they’re Google reCAPTCHA v3 keys (rather than v2), you’ll just need to check the “Enable…” box in Wordfence and paste the Site Key and Secret that you’re given from Google’s admin console. There’s no two-way connection to establish, so there’s no immediate feedback. If you’re using the Google Cloud interface, those keys present slightly differently but you can still get the same details. Also ensure the keys refer to the domain where Wordfence will be trying to use them.
Your WordPress default login/registration page may show red errors similar to, “Invalid site key or not loaded in api.js” in your login page’s browser console if something is wrong. The error will usually point you in the direction of the issue but let me know here if the solution isn’t clear.
Many thanks,
Peter.
Thread Starter
Dave
(@dave22n)
Hey Peter,
Thanks much for the reply. I turned off all plugins except WordFence, and now the keys have been linked to the Google cloud service (showing reCaptcha is Added and Verified there) but still no reCaptcha at login (and Google Cloud has step 3, Review, still pending to “trigger an event to run reCAPTCHA”). There is this console warning however at the login screen before entering anything:
Partitioned cookie or storage access was provided to “https://www.google.com/recaptcha/api2/anchor?ar=1&k=(my key codes etc..)” because it is loaded in the third-party context and dynamic state partitioning is enabled.
Then after a bad log on attempt, this console error comes up:
Cookie “_GRECAPTCHA” has been rejected because it is foreign and does not have the “Partitioned“ attribute.
Does this provide any additional insight into what’s going on?
Thanks again!
Dave
Hi @dave22n, thanks for the extra information.
The first message is informational as reCAPTCHA runs in an iframe from Google’s domain so would be considered third-party. The second suggests a cookie rejection that’s likely breaking functionality.
As Google set the “partitioned” attribute and not you (or Wordfence), I’d first clear any site caches you’re using on your server and/or WordPress caching plugins. Also clear your browser caches and cookies, then test again without any browser extensions enabled either.
If not, check if reCAPTCHA works in an incognito/private window or a different browser to your default as some browsers can handle cookies differently. I believe not serving your site over HTTPS can also present this kind of issue as partitioned cookies require secure connections.
Thanks,
Peter.
Thread Starter
Dave
(@dave22n)
Ahh yeah I shoulda mentioned I’d already tried 3 different browsers (Firefox, Chrome, Safari) and with private/incognito mode on each, so it’s def not a caching issue. I did try again with all their extensions disabled and still no reCAPTCHA. (Both with other plugins enabled and all but Wordfence disabled)
Minor change in console stuff: no more error, but a similarly warning after a bad login attempt:
Cookie “_GRECAPTCHA” will soon be rejected because it is foreign and does not have the “Partitioned“ attribute.
Other things maybe relevant: hosting with Dreamhost; Salient Theme (though disabled that and tried Twenty Twenty-Five with no change… uncertain what else could be relevant.
In the Google cloud console, the key is listed with checkmarks by Add reCAPTCHA to your site and Verify the reCAPTCHA token; and then the Review section is pending, still asking to trigger an event to run reCAPTCHA… and on the overview section, there’s a green mark by “Protected – Your key is requesting tokens and scores – Everything is set up correctly and your site or app is protected.” and then green checks by Frontend and Backend.
So the hangup must be on our end, either with the Wordfence plugin, or some other website or server setting, correct? Again, have disabled all plugins and the theme, and nothing else is amiss with the website..
Appreciate your continued help! Wordfence has come highly recommended by a number of folks in related forums.
Best,
Dave
Thread Starter
Dave
(@dave22n)
Update: after deploying the staging site on Dreamhost to the live site on GoDaddy, both are showing the reCAPTCHA logo at the bottom left corner and the live site additionally has a footer with “By proceeding you understand and give your consent that your IP address and browser information might be processed by the security plugins installed on this site.”
So I guess is working though unsure why one has the footer and one not. But glad it’s the live site.
But a bad login attempt doesn’t add anything else from reCAPTCHA, so am unclear if is actually working. I know there’s a change with v3 that no longer uses puzzles (at least initially), so will continue checking the plugin and cloud console to verify, and edit this answer if I find something verifying functionality. Thanks again for your help.
-
This reply was modified 10 months, 3 weeks ago by
Dave.
Hi @dave22n, thank you for the updates.
That’s correct that v3 doesn’t use puzzles and simply gives the user a human/bot score. If they pass based on Google’s criteria, then they are allowed to submit the form. Apologies for catching this slightly late, I have been on leave. I’m pleased to hear the site is now correctly displaying the reCAPTCHA logo and appears to be behaving correctly.
Peter.
