Google is committed to advancing racial equity for Black communities. See how.

reCAPTCHA: Tips and Guidelines

Important: Version 1.0 of the reCAPTCHA API is no longer supported, please upgrade to Version 2.0. Learn more

User Mistakes

Making mistakes when filling out a form can be a very frustrating exprience for the user. When a user enters the CAPTCHA incorrectly (or any other field in the form), we strongly encourage you to help them by:

  • Re-displaying the form in question with the form data they entered pre-filled, so they don't have to re-enter everything.
  • Adding the error= parameter to http://www.google.com/recaptcha/api/challenge so that the error type is displayed to the user.

reCAPTCHA on an https site

In order to avoid getting browser warnings when you use reCAPTCHA on an SSL site, you should replace http://www.google.com/recaptcha/api with https://www.google.com/recaptcha/api when you request a challenge. Your request to reCAPTCHA would look like this:

<script type="text/javascript"
   src="https://www.google.com/recaptcha/api/challenge?k=your_public_key">
</script>

<noscript>
   <iframe src="https://www.google.com/recaptcha/api/noscript?k=your_public_key"
       height="300" width="500" frameborder="0"></iframe><br>
   <textarea name="recaptcha_challenge_field" rows="3" cols="40">
   </textarea>
   <input type="hidden" name="recaptcha_response_field"
       value="manual_challenge">
</noscript>

Empty reCAPTCHA Fields

If the value of "recaptcha_challenge_field" or "recaptcha_response_field" is not set when you are processing the form, avoid sending a request to www.google.com/recaptcha/api/verify. This allows you to more quickly deal with simple attempts at spamming.