Why reCAPTCHA Is Blocked, and How to Release It

Google reCAPTCHA protects your forms from spam, but it also loads Google code and sets a Google cookie. SureCookie therefore treats it as a tracking service and holds it back until the visitor consents. On most sites that is the correct behaviour. On a site where reCAPTCHA guards your only contact form, it means visitors who have not answered the banner cannot submit that form.

This article covers the five situations we see most often, what causes each one, and how to resolve it. Start with the one that matches your symptom.

Before you begin: reCAPTCHA is handled by resource blocking, which is part of the free plugin. Nothing here needs SureCookie Pro.

First, the Change That Does Not Work

Almost everyone tries the same thing first: moving reCAPTCHA out of Marketing into Functional or Analytics, hoping it will then load freely. It will not.

Only the Essential category is ever released without consent. Every other category, including Functional, waits for the visitor to accept it. So recategorising reCAPTCHA changes which checkbox governs it, not whether it is blocked.

If you want reCAPTCHA to load before consent, the setting you need is Always Allowed, covered in Case 1 below.

Important: releasing reCAPTCHA before consent is a decision worth making deliberately. Regulators have penalised sites over reCAPTCHA more than once, and the remedy accepted in those cases was exactly what SureCookie does by default: load it only after consent. Many sites choose to allow it anyway, on the basis that a spam-protected form is necessary to provide the service. That is a legitimate position, but it should be your choice rather than an accident, and your own legal advisor is the right person to confirm it.

Case 1: The Form Cannot Be Submitted Until the Visitor Accepts Cookies

Issue. Your contact form shows, but submitting it fails or hangs for anyone who has not answered the cookie banner. reCAPTCHA never appears in the page.

Solution. Mark the reCAPTCHA resources as Always Allowed, which exempts them from blocking regardless of consent.

1. Go to SureCookie → Tracking Manager → Scripts and Embeds.
2. Find the rows for www.google.com and www.gstatic.com.
3. Set the behaviour on each to Always Allowed from edit drawer. Badge will say “Not blocked”.
4. Click Save.

Then reload your site in a private window, without accepting the banner, and submit the form.

Case 2: You Set Always Allowed and reCAPTCHA Still Does Not Work

Issue. You have set Always Allowed, and the reCAPTCHA script now loads, but the form still will not submit. Nothing looks obviously broken.

Solution. reCAPTCHA is two separate things, and both have to be released.

• The script is the code that draws the widget or runs the invisible check.
• The verification frame is a small embed reCAPTCHA opens to confirm the visitor is human.

Release only the script and the widget appears, but the check can never complete, so the form fails silently. This is the single most common reason a correct-looking configuration still does not work.

Go back to SureCookie → Tracking Manager → Scripts and Embeds and check for more than one row covering www.google.com. Set Always Allowed on the embed row as well as the script row, then save.

Tip: if you are unsure which row is which, set Always Allowed on every row that names www.google.com. Doing so releases only that address, not other Google services.

Case 3: It Works on Your Other Sites but Not on This One

Issue. You configured reCAPTCHA correctly once and it works on several sites, but one site still blocks it, on the same plugin version and the same settings.

Solution. Always Allowed is stored per site. It is part of each site’s own settings, so it does not travel between installs, and it is not copied when you set up SureCookie somewhere new.

Open SureCookie → Tracking Manager → Scripts and Embeds on the site that is not working and set Always Allowed there too. Expect to repeat this once on every site that uses reCAPTCHA on a form.

Case 4: reCAPTCHA Appears Under Managed by Google Consent Mode

Issue. You can see reCAPTCHA listed under Managed by Google Consent Mode, so you expect Consent Mode to handle it and are surprised that it is still blocked.

Solution. Consent Mode does not release reCAPTCHA, and this is a genuine difference between Google services rather than a fault.

Google Consent Mode works by telling Google products what the visitor consented to, and those products then adjust their own behaviour. Analytics and Ads listen for those signals. reCAPTCHA does not. It loads or it does not load, so the only thing that governs it is resource blocking.

Treat reCAPTCHA as a resource-blocking decision and use Always Allowed as in Case 1. Leaving Consent Mode enabled is correct and changes nothing here.

Case 5: reCAPTCHA Works Only Sometimes

Issue. reCAPTCHA loads on some visits and not others, or works until you clear your cache, with no pattern in your SureCookie settings.

Solution. This is usually a caching or optimisation plugin rather than consent. Plugins that combine JavaScript, or delay it until the visitor interacts with the page, can postpone the reCAPTCHA script past the point where it needs to initialise. We have seen this with WP Compress, and the same class of setting exists in WP Rocket and LiteSpeed Cache.

• Clear every cache layer, including any server or CDN cache, and retest in a private window.
• In your optimisation plugin, exclude the reCAPTCHA script from JavaScript combining and from any “delay until interaction” setting.
• Retest with the optimisation plugin switched off, to confirm which side the behaviour belongs to.

If You Are on an Older Version

Before SureCookie 1.5.0 and SureCookie Pro 1.3.0 there was a genuine bug in this area: an Always Allowed entry released the reCAPTCHA script, while the browser-side protection still held the verification frame. The symptoms look exactly like Case 2, but no amount of reconfiguring fixes it.

If you are on SureCookie 1.4.0 or Pro 1.2.0, update both plugins before changing any settings. The fix needs the two together, so updating only one is not enough.

Next Steps

Once reCAPTCHA is loading, it is worth reviewing what else on your site is held back before consent. See Block Scripts Until Consent (Resource Blocking) for how the blocking list is built, and Using Known Services for how SureCookie recognises services like reCAPTCHA in the first place.