Google reCAPTCHA v2

Google reCAPTCHA v2 includes the “I'm not a robot” checkbox and invisible badge integrations. Standard reCAPTCHA v2 does not provide a general production client-IP allowlist in the classic console.

Staging or test environments

Google provides an official reCAPTCHA v2 test key pair for automated testing. It always returns No CAPTCHA and verification requests pass. The widget displays a warning so the test pair is not mistaken for production protection.

Use the current values from Google's automated-testing FAQ. Never use the test pair on a production form.

Production websites

  1. Turn off the FormTester 365 proxy for the website.
  2. Configure the form plugin or application to skip reCAPTCHA validation only for the two FormTester 365 IP addresses.
  3. Scope the exception to the protected form and its submission endpoint.
  4. If the widget prevents the submit button from working without a token, update the trusted test path as well as the server-side validation.
  5. Confirm reCAPTCHA still appears and validates for visitors outside the FormTester 365 addresses.

If your plugin has no trusted-IP or skip-validation setting, a developer may need to add a server-side hook. Do not disable reCAPTCHA for all visitors.

Was this helpful?