Captcha Not Working: Why It Fails in 2026 and How to Fix It

You click into the form, and where the checkbox should be there's grey nothing. Captcha not working means the challenge doesn't load, doesn't render, or renders and then refuses to let you through. A CAPTCHA is the automated test a site uses to tell people from bots, and its code loads from another company's servers. That's where most of this breaks. Not the same as "verification failed," which hits after you submit and the server rejects your token.

The rest covers symptoms, providers, 2026 causes and fixes for browser, phone and site.

What "CAPTCHA Not Working" Looks Like

Broken captchas look about five different ways, and the one on your screen narrows the cause a lot.

• Blank or grey widget area. The page reserves space but nothing renders. The script was blocked, never requested, or rejected by the page's security policy.
• The checkbox or image challenge never loads. Recaptcha not loading looks like a spinner, a partial frame or an empty box: loading started, then the connection dropped. The audio alternative, there for people who can't solve image grids, fails the same way, since it comes from the same domain.
• An infinite loop. You solve the images, the challenge reloads, and it asks again indefinitely. Usually a session, cookie or clock problem, not a wrong answer.
• "Cannot contact reCAPTCHA" or a connection error. The browser reached the page but not the provider's servers. Network filtering, DNS or a VPN is the first suspect.
• The checkbox ticks but the form stays blocked. The widget worked; the token was never attached or was rejected on submit. A reCAPTCHA answer also lasts only two minutes: once it lapses, the box still looks ticked while the hidden field behind it has been emptied, so the form posts with nothing attached.

Searched for captcha not loading, captcha widget not showing, recaptcha not showing or just broken captcha? Each sits somewhere in that list, and the rest of the article works through the causes.

CAPTCHA Not Working vs Verification Failed vs Invalid CAPTCHA

These three phrases describe different failures, and only the first belongs to this article.

Not working or not loading is client-side: the widget doesn't render, or won't let you complete the challenge. That's this article.

Verification failed means the challenge worked but the server rejected the token. Expired and replayed tokens land here too: every provider issues them single-use and short-lived, two minutes for reCAPTCHA and hCaptcha, five for Turnstile. A low reCAPTCHA v3 score is the same server-side category. For that path, see our walkthrough of how to fix a reCAPTCHA failure and its common causes.

Invalid captcha is the site's own validation message, usually after a mistyped code or a form left open until the challenge expired. Your answer arrived and was turned down; the widget isn't broken. If that's your message, here's what an "invalid captcha" message actually means.

reCAPTCHA, hCaptcha, and Cloudflare Turnstile: Quick Differences

Every provider loads its code a little differently, which changes what you suspect first.

Google reCAPTCHA (v2 checkbox / v3 invisible)

reCAPTCHA v2 is the "I'm not a robot" checkbox, with an image grid behind it when Google wants more convincing. v3 shows nothing and scores you in the background. Both pull code from Google's hosts, so recaptcha not working usually traces back to a blocked request to www.google.com/recaptcha or www.gstatic.com, a site key from another domain, or markup pointing at an old script URL. With v3 there's no widget to watch, so you notice only when the form refuses to submit.

Two details save time. Google publishes www.recaptcha.net as a drop-in replacement for www.google.com where that host is unreachable — the best fix for "cannot contact reCAPTCHA" on networks that filter Google. reCAPTCHA also sets its own cookie, _GRECAPTCHA, for risk analysis, so don't mistake it for a tracker. Enterprise loads from the same hosts via enterprise.js, so the loading advice holds, but verification runs through the reCAPTCHA Enterprise API, not the classic siteverify endpoint.

hCaptcha

hCaptcha shows a checkbox first, then an image task if it wants a second opinion, mostly on privacy-focused sites. The script comes from js.hcaptcha.com, with assets and API calls across other hcaptcha.com subdomains that hCaptcha asks you not to pin, since they vary by region and over time.

When nothing renders, suspect a content blocker filtering those hosts, or an embed script copied without its container — an empty element with class h-captcha and your data-sitekey. What usually isn't the problem: an hCaptcha sitekey works on any domain by default, since allowlisting is opt-in per sitekey — check whether it was ever switched on before chasing a hostname theory. A frame policy on the host page that forbids the provider's iframe also leaves you with nothing.

Cloudflare Turnstile

Turnstile is Cloudflare's challenge, usually a small widget that verifies without puzzles. It loads from challenges.cloudflare.com, and Cloudflare requires that host directly, not proxied or bundled. It breaks when an extension or firewall blocks the host, when the hostname isn't covered by the widget's hostname configuration in the Cloudflare dashboard, or when the widget is injected after the script has run.

Tokens last 300 seconds and can be redeemed exactly once; a slow form or a double submit returns timeout-or-duplicate and needs turnstile.reset(), not a retry. No token, no submission, so a stalled widget holds up the whole form. A managed challenge showing a brief interstitial before it settles isn't a fault.

Why CAPTCHA Is Not Working: Common Causes in 2026

Work backwards from recaptcha not working, or any broken captcha, and you land in one of three places: the script, the network, or the key.

JavaScript disabled or blocked

Effectively every CAPTCHA you'll meet is JavaScript, so with scripting off there's nothing to render. That holds whether you disabled it globally, blocked it for this site and forgot, or work under an enterprise policy. NoScript-style extensions do it selectively: text and images load fine, so the failure looks specific to this site. It isn't.

One caveat explains the occasional site that still works: reCAPTCHA v2 has a documented <noscript> fallback that renders the challenge in a plain iframe. Few integrations include it, so treat a working no-JS challenge as the exception.

Ad blockers, privacy extensions and tracking protection

Content blockers filter requests against blocklists, and a few lists file challenge scripts under trackers. Block google.com/recaptcha, hcaptcha.com or challenges.cloudflare.com and the widget area sits empty. Strict script blockers, antivirus shields and DNS-level blockers do the same. The trade-off is real: whatever cuts cross-site tracking tends to break third-party challenge widgets, so whitelist the single site instead of uninstalling anything.

Third-party cookie restrictions and cross-site state

This is the part that dated fastest. Google retired the Privacy Sandbox on 17 October 2025, dropping ten remaining APIs; Chrome began deprecating them in Chrome 144 in January 2026, with removal targeted for Chrome 150. Third-party cookies were never removed from Chrome and stay indefinitely. That's why 2024-vintage guides blaming imminent cookie deprecation don't match your browser.

What still bites is ordinary cookie restriction, which varies by browser. Chrome allows third-party cookies by default, blocks them in Incognito, and blocks them everywhere with one toggle. Safari blocks them outright. Firefox's Total Cookie Protection, on by default in Standard mode, partitions them into a separate jar per site rather than blocking them, and Strict mode blocks cross-site cookies entirely. Challenge widgets load inside third-party frames, so aggressive restriction can leave one spinning or looping.

Two specifics. When Chrome restricts third-party cookies it shows an eye icon in the address bar; clicking it grants that one site an exception, better than switching protection off globally. For developers, the Storage Access API is the sanctioned way for an embedded frame to request cross-site state instead of relying on cookies that partitioning has already isolated.

Content Security Policy (CSP) blocking scripts

CSP, short for Content Security Policy, is a header the site sends to declare which hosts it trusts for scripts, frames and styles. Leave the provider out of script-src or frame-src and the browser refuses the request, logs a violation and draws nothing. Visitors can't route around it; that's the owner's job. Exact directives are in the developer section below, and the host most often missed isn't the script host but recaptcha.google.com in frame-src.

VPN, proxy, DNS and firewall filtering

A VPN or proxy changes your exit IP address, which can trigger extra challenges. More disruptively, VPN-bundled ad blocking, private DNS profiles, corporate firewalls and school networks often filter provider domains, producing a connection error instead of a widget.

Outdated browser, cache/cookies and incorrect system clock

Old browser versions lack the APIs and TLS support the widget expects. Stale cached scripts and corrupted cookies break sessions for one site while others work.

Clock problems deserve separating, because the popular advice overstates them. A few minutes off doesn't break TLS: certificate validity runs in days, and CAs commonly backdate the start time to absorb exactly this. Minutes of drift break token timing instead — with a two-minute reCAPTCHA token, a device running behind posts a token the server already treats as expired, which looks like a challenge that keeps asking you to try again. Hours or days of drift produce certificate errors and a challenge that won't connect at all.

Mixed HTTP/HTTPS content and outdated api.js

If an HTTPS page requests the challenge script over HTTP, browsers block it as mixed content and the widget silently disappears. Same for pages still referencing deprecated script paths instead of the current api.js endpoint, or loading two conflicting versions at once.

Site misconfiguration (invalid site key, domain mismatch)

The site key is the public half of a key pair. With reCAPTCHA and Turnstile it's tied to the hostnames its owner registered; with hCaptcha that restriction is opt-in. Mistype it, paste one from another property, or forget the hostname you're serving from, and the provider draws nothing. The invalid key or domain error waits in the console.

How to Fix CAPTCHA in Your Browser (Step-by-Step)

Do these in the order given; most people never reach step four. It's the practical answer to how to fix captcha as a visitor, and to captcha not working in Chrome in particular.

1. Hard refresh and rule out a stale page

Ctrl+F5 on Windows, Cmd+Shift+R on macOS reloads the page without reusing the cache, throwing out the half-loaded or stale script behind a lot of empty widget boxes. Cheapest cause there is, so rule it out before you touch any settings.

2. Enable JavaScript

Check JavaScript is allowed globally and for this domain, since per-site exceptions outlive the reason you added them. Chrome buries it under Settings, Privacy and security, Site settings, JavaScript. Check too whether NoScript or similar is holding the page.

3. Try Incognito / private mode (extensions off)

A private window is the fastest way to take extensions out of the picture in Chrome and Edge, where they're off there by default. Firefox runs extensions in private windows, and Safari can too, so disable them by hand there. Note that Incognito also blocks third-party cookies, so you're changing two things at once: a blank widget that fills in privately points at an extension, while one that renders and then loops points at cookie restriction, and step five is your fix.

Safari's Prevent cross-site tracking lives under Settings, Privacy on macOS, and Settings, then Apps, then Safari on current iOS. Switching it off is global with no per-site exception, so turn it back on once you're through the form.

4. Disable ad blockers and privacy extensions

If the private window worked, bring extensions back one at a time until it breaks again. Most blockers offer a per-site pause, which beats going unprotected elsewhere. Watch strict and anti-tracking lists, and antivirus add-ons, which filter these hosts without saying so.

5. Clear cache and cookies for the site

Clear the data for this domain only. In Chrome, click the tune icon at the left of the address bar — the sliders that replaced the padlock in Chrome 117 — then site settings, then delete stored data. If third-party cookies are the problem rather than stale data, the eye icon in the same bar grants this site an exception. You're clearing the expired session or mangled cookie behind a challenge that reloads forever after a correct solve.

6. Turn off VPN or proxy

Disconnect the VPN, disable any proxy in your system network settings, and reload. Also switch off ad-blocking or "threat protection" bundled with the VPN client: that layer filters domains independently and keeps blocking the challenge even when the tunnel is down.

7. Change DNS or try another network

If your resolver filters provider domains, point your OS network settings at a mainstream public DNS service, or tether to your phone and reload. A challenge that works on mobile data and nowhere else puts the filtering in your router, DNS or firewall, not your browser.

8. Update your browser

Install the latest stable version, restart, and confirm the number on the About page rather than trusting auto-update. Outdated engines miss APIs the widget needs, and abandoned builds accumulate certificate problems that break connections to provider servers. Managed browsers may need the update pushed by an administrator.

9. Fix system date and time with auto sync

Enable automatic date, time and time zone. Minutes of drift expire a two-minute token on arrival, which looks exactly like a captcha that keeps asking you to try again; hours or days produce certificate errors and a challenge that never connects.

10. Try another browser or device

Load the same page in another browser, or on a phone. If it works there, the problem is local and the steps above will narrow it down. If it fails on every browser and every network, the site is misconfigured and the developer section applies.

Mobile Fixes: Android and iPhone

Captcha not working on mobile usually comes down to where the page is open rather than the phone itself.

Escape the in-app browser. Tapping a link inside a social or messaging app opens it in a WebView, an embedded browser with reduced features and separate storage. Most reports of captcha not working on mobile start here. Open the link in Chrome or Safari from the app's menu, especially for logins.

Check private DNS and VPN profiles. On Android, Settings, Network and internet, Private DNS. On iPhone, Settings, General, VPN and Device Management. Ad-blocking DNS profiles filter provider domains and leave empty widgets.

Clear site data for that domain. In Chrome, Settings, Privacy and security, Clear browsing data, then cookies and site data. On iPhone the Safari controls sit in the system Settings app: Settings, Apps, Safari, Advanced, Website Data on current iOS, then remove the single site.

Switch off data-saver and lite modes. These defer or proxy background requests, and some mobile browsers strip third-party scripts while active, leaving the widget area empty. Chrome's Lite mode has been gone since 2022, so this applies to Opera Mini, Samsung Internet and vendor browsers that still ship a compression mode.

If you cannot see the CAPTCHA at all, pinch to zoom out, rotate to landscape, or request the desktop site. Narrow viewports sometimes render the widget off-screen or behind a sticky element.

Developer Fixes: When the CAPTCHA Widget Won't Load on Your Site

When the captcha widget is not showing for every visitor, or recaptcha not showing only on one hostname, the cause is your configuration, not their browsers.

Check site key, secret key and allowed domains

Confirm the public site key in your markup matches the dashboard property, and keep the secret key server-side. Domain scoping differs by provider:

• reCAPTCHA ties a key to a list of supported domains, up to 250 per key; localhost works only if you add it yourself. Keep separate development and production keys, and allow localhost on the development one.
• hCaptcha serves a sitekey on any domain until you enable allowlisting for that sitekey, and rejects localhost and 127.0.0.1 outright; for local work, add a hosts entry like 127.0.0.1 test.mydomain.com and browse that name instead. Both hCaptcha and reCAPTCHA publish test keypairs — test environments only, since they provide no protection.
• Turnstile manages hostnames per widget in the dashboard, including an "Any Hostname" option for cases where an allowlist doesn't fit.

Load the correct script

Use the current endpoint — reCAPTCHA's api.js (or enterprise.js), Turnstile's api.js, or hCaptcha's api.js from js.hcaptcha.com — loaded once from the provider's own domain, never self-hosted, bundled or proxied. Check it isn't deferred past the point where your code calls render, and that no plugin, theme or tag manager adds a second copy; two versions fight over the same container. Where www.google.com is unreachable for your users, swap in www.recaptcha.net across every reCAPTCHA reference on the site.

Fix CSP and script-src directives

If you send a Content Security Policy, extend it for the provider. The published requirements:

Three things to pin down. Missing frame-src entries leave a blank space with a violation in the console. hCaptcha asks you not to hard-code asset subdomains such as newassets.hcaptcha.com, since they change by region and over time — use the wildcard. And a policy from a CDN or reverse proxy doesn't replace yours: browsers enforce each policy independently, so the strictest combination wins. Allowing the provider in your application header won't help while the proxy header omits it.

Serve pages over HTTPS with no mixed content

HTTPS for the whole page, every asset reference explicitly https:// — protocol-relative // URLs are an HTTP-era leftover. One hard-coded http:// script tag and the browser drops the challenge as mixed content while everything around it renders normally, so it hides well. Redirect chains that dip back to HTTP do the same.

Handle expiry in the client, not just the server

Register the expiry callback. reCAPTCHA and hCaptcha answers lapse after two minutes, Turnstile tokens after five; with no expired-callback, the widget sits looking solved while the hidden field behind it is empty, and your server reports a missing token rather than an expired one. Generate tokens at the moment of the action instead of on page load, and reset the widget rather than replaying a token, since every provider rejects a second redemption.

Check the browser console and network tab

Open developer tools and reload. The console names the failure — invalid key, invalid domain, CSP violation, mixed content. In the network tab, filter by the provider's domain to see whether the request went out, got blocked, or returned an error. Do this in a clean profile with extensions off, or you'll chase a server-side bug that turns out to be an ad blocker.

CAPTCHA Troubleshooting Checklist

For users

• Hard refresh the page first
• Confirm JavaScript is enabled for the site
• Test in a private window, disabling extensions by hand in Firefox and Safari
• Pause blockers for this one site
• In Chrome, allow third-party cookies via the address-bar eye icon
• In Safari, untick "Prevent cross-site tracking", then re-enable
• Wipe cookies and cache for the domain
• Disconnect VPN, proxy and filtering DNS
• Update the browser; auto-sync the clock
• On mobile, leave the in-app browser
• Retest on another network

For developers

• Verify site key, secret key and hostname scoping per provider
• Local development per provider: localhost on a reCAPTCHA dev key, a hosts entry for hCaptcha, test keys in test environments only
• Load the provider script once, unproxied, from its own domain
• Allow provider domains in script-src, frame-src, plus style-src/connect-src where required
• Check for a second CSP from a CDN or proxy — policies stack, strictest wins
• Serve everything over HTTPS with no mixed content
• Wire up the expired callback and generate tokens at submit time
• Read the console and network tab in a clean profile
• Confirm the container exists before render runs
• Test on Android, iOS and a WebView

When to Contact the Website Administrator

Escalate when the evidence points server-side and no browser change helps.

Contact the site owner if the console reports an invalid site key or domain on load; only they can correct it. Do the same if the challenge is missing for every visitor on multiple browsers, networks and devices — that rules out your setup. CSP comes from the host, so a policy blocking the provider's domain is also their job. Give them the exact error text, the page URL, your browser version, and say you tested with extensions off. Vague reports wait around. That one gets fixed.

Automated testing note: CapMonster Cloud

If you maintain a site, confirming a repaired widget still loads and completes is part of the fix. CapMonster Cloud handles reCAPTCHA v2, v3 and their Enterprise variants in automated testing workflows on properties you own or are authorized to test, and fits Selenium or Puppeteer suites. The CapMonster Cloud documentation for reCAPTCHA v2, v3, v2 Enterprise, and v3 Enterprise sets out the request format.

Legal NB: Test only properties you own or are authorized to test, and respect each site's terms of service and applicable law.

Closing

CAPTCHA not working is a loading problem, not a verification problem. Start from the symptom, match it to a cause — blocked scripts, privacy settings, network filtering, an outdated browser or a site misconfiguration — then work the browser steps in order. If the challenge is broken for every visitor or the site key is rejected on load, escalate to the site administrator with your evidence.

Related articles

• How to fix a reCAPTCHA failure: common causes and solutions
• What an "invalid captcha" message means
• CapMonster Cloud documentation: reCAPTCHA v2, v3, v2 Enterprise, v3 Enterprise