Usually one of three things. Your v3 threshold is too low, you are using one global threshold instead of one per action, or the token is never validated server-side. If all three are right and junk still arrives, it is being typed by a person, and no captcha detects that.
Fix the configuration first
Most reCAPTCHA failures are setup rather than the product.
Your threshold is too low
reCAPTCHA v3 returns a score from 0.0 to 1.0 and you decide what to reject. Google’s documented starting point is 0.5, described as a default to tune away from rather than a target. Plenty of implementations install it, leave it at the default, and never look again.
Open the reCAPTCHA admin console and look at your score distribution. Google publishes it per site, with a breakdown for your top ten actions.
You are using one threshold everywhere
v3 supports named actions, and a contact form, a login and a password reset should not share a cutoff. One global threshold is a compromise that is simultaneously too loose for the endpoint being attacked and too tight for the one that is not.
Name one action per event and set the threshold per endpoint.
The token is never checked server-side
A surprising number of implementations render the widget, collect the token and never verify it. The form submits regardless of the score. Confirm your backend calls Google’s verification endpoint and acts on the result, and that the action name it compares against matches the one used on the page.
You are judging it too early
reCAPTCHA learns from real traffic on your site, so scores in staging or immediately after install differ from production. Google’s own advice is to run it without taking action first and set thresholds from real traffic. Give it a week before concluding anything.
You raised the threshold and now real people are blocked
Raising every endpoint toward 0.9 blocks people on shared IPs, VPNs and privacy browsers long before it stops anyone determined. If your distribution shows almost everything scoring high and you are still losing submissions, the problem is your threshold or your backend logic, not the score.
Then accept what it cannot do
Configure all of that correctly and some spam will still arrive, because of what a captcha is.
A captcha answers one question: does this session look like a human.
That is not the question you need answered. You need to know whether this enquiry is real, and those are different things.
| What arrives | Does reCAPTCHA catch it? |
|---|---|
| A script filling your form | Usually |
| A headless browser | Often |
| A solving service paid per captcha | No |
| A person typing an SEO pitch | No |
| A click farm worker filling a form by hand | No |
| A real person with no intention of buying | No |
Everything below the third row is a human at a keyboard. They pass every captcha ever built, because they are exactly what a captcha exists to let through.
If your junk reads like a person wrote it, no amount of threshold tuning will help.
What does work on human spam
Content and reputation, assessed after the submission arrives.
A server-side filter reads the message, the sender’s address and the IP’s history, and scores on that. It is the only layer that can tell a quote request from a web design pitch, because it is the only one looking at what was said.
Worth pairing with a honeypot and a timing check, which are free, take minutes, and handle the automated share that a badly-configured captcha was letting through anyway. The full comparison is in how to stop form spam.
If you want to drop the captcha entirely
Many sites can. A honeypot plus a timing check plus server-side filtering covers most of what a captcha was doing, with nothing for your visitor to solve. Cloudflare Turnstile is also worth a look if you want to keep a challenge: it runs in the background without interrupting the visitor, and has a fully invisible mode.
Longer version: stopping form spam without a captcha.
What the junk is doing to your reporting
While you are tuning thresholds, the junk that does get through is being counted.
Every spam submission that reaches your system is recorded as a lead, attached to whatever source the visit came from, and included in that channel’s numbers. The channel carrying the most spam ends up with the best apparent cost per lead, and the budget follows it. What spam leads do to your marketing numbers covers that in full.
Lead Source takes that away from the captcha entirely, by being the form: prevention sits in the form rather than in a widget on top of it. That means switching forms, not adding one more layer to the one you have. See how it works, or how the source attribution behind it is captured.