Replies: 0
Hello WordPress Community,
I am experiencing issues with reCAPTCHA v3 in Wordfence Login Security, where multiple users are unable to log in due to the error “CAPTCHA EXPIRED” or getting locked out. This issue occurs across multiple browsers, but is particularly problematic in Safari (both macOS and iOS, especially in Private Mode). Below, I outline the problem, the steps taken so far, and my system details.
Issue Description:
• reCAPTCHA v3 is enabled in Wordfence Login Security to prevent bot logins.
• Users across different browsers (Safari, Firefox, and sometimes Edge) experience “CAPTCHA EXPIRED” when trying to log in.
• Safari users in Private Mode are the most affected, but even in normal browsing mode, the issue is inconsistent.
• The problem does not always occur in Chrome, though some users have reported intermittent failures.
• Disabling reCAPTCHA v3 in Wordfence allows users to log in without issues, confirming that reCAPTCHA is the source of the problem.
Steps Taken to Troubleshoot:
1. Checked Plugin and WordPress Versions:
• WordPress, Wordfence, and all plugins are updated to the latest versions.
• PHP version: 8.0
• MySQL version: 5.7
• No errors in the WordPress debug log.
2. Confirmed Caching is Not Causing Conflicts:
• W3 Total Cache settings checked – login page and wp-login.php are excluded from caching.
• Object Cache and Database Cache are disabled.
• Minify settings adjusted to exclude recaptcha/api.js to ensure it loads properly.
3. Investigated Browser-Specific Issues:
• The issue occurs most frequently in Safari (especially in Private Mode) but has also been reported in Firefox and Edge.
• In Safari, toggling “Prevent Cross-Site Tracking” temporarily fixes the issue, but requiring users to change their browser settings is not ideal.
• Clearing cache and cookies in all affected browsers did not resolve the issue.
• Confirmed that the reCAPTCHA v3 badge appears in the bottom corner, meaning the script is loading properly.
4. Tried Adjusting reCAPTCHA Settings in Wordfence:
• Lowered the reCAPTCHA v3 threshold to make it less sensitive to low scores.
• Tested in Test Mode to log reCAPTCHA scores—affected users often receive very low scores (0.0 - 0.1), which may trigger login restrictions.
• No issues with reCAPTCHA key or secret—no invalid key errors in Wordfence logs.
Questions:
1. Why is reCAPTCHA v3 failing or expiring across multiple browsers, particularly in Safari, Firefox, and Edge?
2. Is there a way to configure Wordfence reCAPTCHA v3 to work properly in Safari Private Mode and prevent other browsers from being affected?
3. Are there known conflicts between Wordfence reCAPTCHA and privacy-focused browser settings (e.g., cross-site tracking prevention, cookie handling)?
4. Would switching to reCAPTCHA v2 (checkbox) or an alternative like Cloudflare Turnstile improve compatibility?
5. Are there specific server or security headers that could be adjusted to prevent browsers from blocking reCAPTCHA verification?
I would appreciate any guidance on resolving this issue. Let me know if you need additional details.
Thanks in advance for your help!
