I just spent several hours chasing down an issue with GoDaddy and Google’s reCAPTCHA, and I wanted to post the solution just in case anyone else is having a similar issue and can’t find the solution.

This issue was a client who uses GoDaddy Managed Hosting, I don’t know if a similar issue may happen with other hosting options.

The Problem

Any user logging into an the wp-login.php form would be met with the error message:

Incorrect CAPTCHA. Please try again.

Keep in mind, this page was setup to use a Google Recaptcha v3 which means that there isn’t actually anything for the user to do. It makes the “human or bot” decision completely in the background, which is great for the user until it consistently fails.

I tried quite a few different options to see if this was a website/hosting issue or a me issue – logging in from different browsers, using Private mode, using different WiFi networks, using a cellular network, and even different cellular networks in different areas of town – and they all ended up with the same error message.

The Solution(s)

The first problem to solve was logging in.

Since the wp-login form was completely non-functional, and I didn’t have any FTP credentials, I had to use get into the WordPress admin dashboard through the GoDaddy interface. This isn’t how I normally access wp-admin, but it worked when nothing else would.

If you need similar access (and have GoDaddy Managed Hosting), you can find a link to your WordPress dashboard on your dashboard.godaddy.com page, on the bottom right in the “Quick Links” box. Look for the “WordPress Admin” link.

Once I was able to login, the next problem was chasing down what was triggering the CAPTCHA.

This site uses a WordPress security plugin, as well as a custom login page plugin, a site builder, and quite a few other plugins. It was also *not* made by me, so I am not 100% sure how the original developer implemented things like login security (or if he even did).

I ended up going through almost every single plugin screen – there were 5 plugins that had some sort of CAPTCHA capability, and I ended up removing the keys from all of them and then, when that didn’t work, I deactivated them all. And *still* the “Incorrect CAPTCHA” error messages persisted.

On the login screen, there was no indication of a CAPTCHA being used, but after inspecting the source of the login page, I found the following URL:

https://captcha.wpsecurity.godaddy.com/api/v1/captcha/script

Which told me that there was still some sort of GoDaddy CAPTCHA operating.

I spent a little bit of time looking through GoDaddy’s documentation, which was no help, and mentioned nothing I could find about any sort of CAPTCHA functionality. I also looked through all the managed hosting options on the GoDaddy dashboard, which proved to be no help (and that interface is *so poorly laid out*.) However, I realized that when I was going through plugin settings I used the wp-admin/plugins.php page, and *not* the left-hand sidebar menu. In frustration, I was going back through these plugins to see if I missed something, when I stumbled across a “GoDaddy” menu option that *was not* on the plugin list page, it was only on sidebar. And wouldn’t you know, that if clicked on that GoDaddy menu option I could drill down through “Tools → CAPTCHA” and turn off the CAPTCHA forwp-admin` and WordPress comments.

This turned out to do the trick. After turning off those options (which, weirdly, took a couple of tries for the new settings to “stick”) logins started working almost immediately.

TL;DR: If you have turned off all the CAPTCHA in 3rd-party plugins, make sure to check the GoDaddy settings in the WordPress sidebar (GoDaddy→Tools→CAPTCHA).

Still Questions

I still have a few questions about this whole issue, which seemed to happen overnight a couple of days ago.

I haven’t heard about this being a widespread issue (at least, none of my searches turned up anything that indicated this may be widespread), so I wonder if this is a GoDaddy issue or a CAPTCHA issue. It would appear that GoDaddy is using some sort of a “v3-like” reCAPTCHA (since there is no obvious user interaction), but I don’t know if it is using Google’s version or something else.

I may try and re-enable an “official” Google ReCAPTCHA v3 in a few days to see if I can pinpoint where the issue actually was, but right now I am just glad that I have the initial issue fixed.