reCAPTCHA v3

v3 runs continuously rather than at a moment. It observes interactions across the page, builds a picture of the session, and returns a score where 1.0 means “behaves like the humans we know about” and 0.0 means “behaves like the automation we know about.” There is no challenge to fail, so there is nothing for the visitor to notice.

Google’s own guidance is that the score is an input to your risk logic — show a challenge, require verification, route for review. What virtually every plugin and form builder does instead is if (score < 0.5) reject.

That single line converts a ranking signal into a binary gate, which is the wrong use of it in both directions: it discards the ordering information that made the score useful, and it commits you to a cut-off you have never measured.

At the low end of the score range it is a reasonable detector of unsophisticated automation, and unlike v2 it costs your real visitors nothing to pass. On a form where you were previously running no defense at all, wiring v3 in and rejecting the bottom of the distribution will remove volume without removing conversions.

What it stops after that depends on a decision you have to make with no information: where to put the line. Google does not publish what a 0.4 means in your industry, on your traffic, at your time of day, and it cannot — the model is calibrated globally and your form is not the world.

Directly, by the same market that defeats v2. Solver services sell v3 tokens with a target score attached; the way you produce a high-scoring token is to solve the challenge from an aged browser profile on a residential IP that has a plausible history. Reputation is a model input, and model inputs are purchasable.

But the more common failure is quieter, and it is the reason this page exists. v3 scores unfamiliarity, and the humans who look most unfamiliar to Google are the ones running a VPN, blocking third-party cookies, using Firefox in strict mode, or browsing from a corporate egress that thousands of colleagues share. That is a description of a security-conscious enterprise buyer.

So raising the threshold to catch more bots starts rejecting your most valuable segment, and it does it silently — a v3 rejection produces no error the visitor understands and no row you ever see. You cannot tell the difference between “the threshold is working” and “the threshold is eating deals,” because both look like a lower number of submissions.

And when the submitter really is a person, the score is high, correctly. v3 is a good model of whether a browser is being driven by a human. It has no view whatsoever on whether that human wants to buy anything.

Use it, and use it as a field rather than a filter. Store the score on the submission. Do not reject on it.

That gives you three things a gate destroys. You can look at the score distribution on your own traffic and discover where your line actually belongs. You can route rather than reject — low scores go to a review queue or trigger email verification instead of vanishing. And once a submission carries an outcome, you can ask the only question that settles it: did the low-scoring submissions convert worse?

That last one is worth stating plainly, because it is the closest any incumbent defense comes to what we are building. The score is a prediction. The verdict is what happened. A prediction you never grade is a number you are trusting for no reason.