Google reCAPTCHA v3 and Enterprise

reCAPTCHA v3 assigns a risk score instead of always showing a challenge. Automated traffic can receive a low score even when the FormTester 365 submission is legitimate.

reCAPTCHA v3 test environments

Create a separate v3 key for staging or automated tests. Google notes that test-environment scores may not reflect production traffic because v3 learns from real interactions.

Do not substitute the reCAPTCHA v2 test pair for a v3 integration. See Google's automated-testing FAQ.

reCAPTCHA v3 production websites

  1. Turn off the FormTester 365 proxy for the website.
  2. In your score or enforcement logic, allow the two FormTester 365 addresses to pass the CAPTCHA-specific decision.
  3. Limit the exception to the expected hostname, action, form, and submission endpoint.
  4. Keep normal score thresholds, hostname checks, and action validation for all other traffic.

reCAPTCHA Enterprise

reCAPTCHA Enterprise supports a trusted IP allowlist for applicable web integrations. Add both FormTester 365 addresses to the allowlist and keep the exception scoped to the protected form when your architecture permits it.

See Google Cloud's reCAPTCHA website setup for the current allowlist workflow.

After making a change, run a FormTester 365 manual test and confirm a normal browser request is still evaluated by reCAPTCHA.

Was this helpful?