produKtnz

Amazing! thank you so much for your guide. I read through it and it’s pretty close to the 3 hour journey i went through 😉

Also this is nice – Best Practices
Don’t over-protect: Only enable reCAPTCHA on downloads that need protection. Too many CAPTCHAs can frustrate legitimate users.

I only ever have a captcha on large downloads on bmsworld.nz, so i completely agree with that best pratice! <3

lool – only 2 minutes after i posted that, I get the following output and everything is working again.
I last changed the API restrictions and specified the referrer IP as my servers WAN IP and it’s working.

However you documentation and guides are out of date – Google now force you to use the Cloud Console and generate a Service Worker Account as well as many other things.
So please consider updating your documentation (try to follow your current guide on a new setup and it will NOT work)

[2026-01-08T01:20:28+00:00] Parsed: valid=NULL invalidReason= score=NULL errorMessage=Requests from this referer are blocked.
[2026-01-08T01:27:56+00:00] HTTP OUT: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:27:56+00:00] HTTP OUT body: {“event”:{“token”:”REDACTED(len=1700)”,”siteKey”:”6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,”expectedAction”:”DOWNLOAD”}}
[2026-01-08T01:27:56+00:00] HTTP IN: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:27:56+00:00] HTTP IN code: 200
[2026-01-08T01:27:56+00:00] HTTP IN body: {
“name”: “projects/REDACTED/assessments/891e7e4369000000”,
“event”: {
“token”: “REDACTED”,
“siteKey”: “6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,
“userAgent”: “”,
“userIpAddress”: “”,
“expectedAction”: “DOWNLOAD”,
“hashedAccountId”: “”,
“express”: false,
“requestedUri”: “”,
“wafTokenAssessment”: false,
“ja3”: “”,
“ja4”: “”,
“headers”: [],
“firewallPolicyEvaluation”: false,
“fraudPrevention”: “FRAUD_PREVENTION_UNSPECIFIED”
},
“riskAnalysis”: {
“score”: 0.9,
“reasons”: [],
“extendedVerdictReasons”: [],
“challenge”: “CHALLENGE_UNSPECIFIED”,
“verifiedBots”: []
},
“tokenProperties”: {
“valid”: true,
“invalidReason”: “INVALID_REASON_UNSPECIFIED”,
“hostname”: “www.bmsworld.nz”,
“androidPackageName”: “”,
“iosBundleId”: “”,
“action”: “”,
“createTime”: “2026-01-08T01:21:28.442Z”
},
“accountDefenderAssessment”: {
“labels”: []
}
}

[2026-01-08T01:27:56+00:00] Parsed: valid=true invalidReason=INVALID_REASON_UNSPECIFIED score=0.9 errorMessage=
[2026-01-08T01:28:42+00:00] HTTP OUT: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:28:42+00:00] HTTP OUT body: {“event”:{“token”:”REDACTED(len=1700)”,”siteKey”:”6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,”expectedAction”:”DOWNLOAD”}}
[2026-01-08T01:28:42+00:00] HTTP IN: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:28:42+00:00] HTTP IN code: 200
[2026-01-08T01:28:42+00:00] HTTP IN body: {
“name”: “projects/REDACTED/assessments/ffc4be4369000000”,
“event”: {
“token”: “REDACTED”,
“siteKey”: “6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,
“userAgent”: “”,
“userIpAddress”: “”,
“expectedAction”: “DOWNLOAD”,
“hashedAccountId”: “”,
“express”: false,
“requestedUri”: “”,
“wafTokenAssessment”: false,
“ja3”: “”,
“ja4”: “”,
“headers”: [],
“firewallPolicyEvaluation”: false,
“fraudPrevention”: “FRAUD_PREVENTION_UNSPECIFIED”
},
“riskAnalysis”: {
“score”: 0.9,
“reasons”: [],
“extendedVerdictReasons”: [],
“challenge”: “CHALLENGE_UNSPECIFIED”,
“verifiedBots”: []
},
“tokenProperties”: {
“valid”: true,
“invalidReason”: “INVALID_REASON_UNSPECIFIED”,
“hostname”: “www.bmsworld.nz”,
“androidPackageName”: “”,
“iosBundleId”: “”,
“action”: “”,
“createTime”: “2026-01-08T01:28:28.018Z”
},
“accountDefenderAssessment”: {
“labels”: []
}
}

[2026-01-08T01:28:42+00:00] Parsed: valid=true invalidReason=INVALID_REASON_UNSPECIFIED score=0.9 errorMessage=

Hello, Unfortunately the issue has not been resolved.
Because this is a virtualmachine, I have rolled it back to June last year and the plugin still isn’t working. I have even disabled Insecure content fixer which instantly breaks the site sending it into an endless loop, so it doesn’t work at all.

Sigh.
I don’t think you can fix this

• This reply was modified 5 years ago by produKtnz.

Login