WooCommerce checkout can fail even when no failed orders or obvious application errors appear in the dashboard. In this case, customers reported CAPTCHA failures that prevented orders from being submitted, but internal testing did not reproduce the problem consistently. The root cause was an invalid Google reCAPTCHA integration: the site keys were still connected to a Google Cloud project that had been deleted. Creating a new reCAPTCHA project and replacing the keys restored checkout functionality.
Issue background
Multiple customers reported that they could not complete purchases because the CAPTCHA validation failed during checkout. The issue was intermittent enough that standard internal testing did not immediately reproduce it, and the WooCommerce order list did not contain failed orders corresponding to the reports.
This combination can make diagnosis difficult. A CAPTCHA can block the form before WooCommerce creates an order record, so the absence of failed orders does not rule out a checkout problem.
The site used Google reCAPTCHA to protect the checkout process from automated submissions and spam.
Diagnosis
The first step was to test the checkout flow and review the site’s CAPTCHA configuration. No obvious frontend error appeared during the initial tests, so the investigation moved to the Google reCAPTCHA account and project configuration.
The configured reCAPTCHA site and secret keys were tied to a Google project that had been deleted. Although the keys were still saved in WordPress, the backing project no longer existed, which made the credentials invalid.
This explains why the problem could be reported by customers without producing a normal WooCommerce failed-order record. The reCAPTCHA request failed before checkout submission completed.
Resolution steps
- Reproduce the checkout flow. Test checkout as a logged-out customer and use the same browser, device type, and payment flow reported by affected customers when possible.
- Check browser developer tools. Review the Console and Network panels for failed requests to Google reCAPTCHA endpoints, invalid-key messages, blocked scripts, or domain mismatch errors.
- Review the WordPress CAPTCHA settings. Identify where the Google reCAPTCHA site key and secret key are stored. Depending on the site, this may be in a checkout security plugin, a form plugin, WooCommerce integration settings, or custom code.
- Verify the keys in Google reCAPTCHA. Sign in to the Google reCAPTCHA admin console and confirm that the registered key still exists, belongs to an active Google project, uses the correct reCAPTCHA version, and includes the current domain.
- Create a new reCAPTCHA project when needed. If the original project or key has been deleted, create a replacement project under a managed organizational account. Register the production domain and any required staging domains.
- Replace both credentials. Update the site key and secret key in WordPress. Mixing a new site key with an old secret key will cause validation to fail.
- Clear caches. Purge page, server, CDN, object, and browser caches so the checkout loads the updated reCAPTCHA configuration.
- Test the complete order process. Submit controlled test orders and confirm that CAPTCHA validation passes, checkout completes, and the order reaches WooCommerce normally.
- Test common customer conditions. Check guest checkout, private browsing, mobile devices, strict browser privacy settings, and any applicable account-based checkout flows.
When replacing reCAPTCHA credentials, use an account controlled by the organization rather than an individual employee. This reduces the risk of keys becoming inaccessible or invalid when personal accounts, projects, or permissions change.
Final outcome
After a new Google reCAPTCHA project was created and the site was connected with fresh keys, checkout returned to normal. Customers could complete purchases without further CAPTCHA failures.
The key lesson is that saved API credentials can remain visible in WordPress even after the external project behind them has been removed. When a CAPTCHA or other third-party integration fails without clear WooCommerce order errors, verify the external account, project, domain registration, and credential status—not just the plugin settings inside WordPress.
For help troubleshooting WooCommerce checkout failures, Google reCAPTCHA errors, or other WordPress integrations, contact Freshy.
