Third party hCaptcha have stopped the free service w/o sitekey/registration - no more user registrations possible on XF installs with default settings

smallwheels

Well-known member
Affected version
2.3.8 and earlier
Technically not a bug of XF but with huge effects on XF-installations with default settings for registrations. I stumbeled about this problem report:


I had same issue with my 2 sites , hCaptcha service is abonded service now i guess
Just tried to register on my test forums and got this:

Bildschirmfoto 2026-02-01 um 06.40.23.webp

So it seems that hCaptcha has stopped the free service in the current form. Must have been very recently as I have been using it on my forums for new members and had people register up until yesterday. I had even checked their homepage just recently as in the XF registration settings it reads:

No extra configuration is required for this CAPTCHA. But if you would like additional features, such as difficulty preferences and analytics, you should get your own API keys from https://www.hcaptcha.com/ and enter them below.

They still have a free tier after registration, however, the UX of their site is pretty horrible.

After registration you can generate a site key and secret, feed it into the XF ACP and it will work again. Could however not find the difficulty preferences mentioned - either they are no longer there or failing to find those is a result of hCaptcha's horrible UX.

Anyhow: Seems they have stopped offering the service w/o registration/sitekey starting with Feb. 1st 2026 and - due to having no contact date from those using the service w/o sitekey/registration - they could not notify them proacively but only via the small message in the captcha itself. At least this is my assumption as I could not find anything about that on their webpage.

The consequence is that any new or existing XF-installation that uses the standard setting for registration (hCaptcha free w/o sitekey) won't accept new user registrations until either a sitekey is added (afer registration at hCaptcha.com) or a different captcha method is selected.

So the wording in ACP and default settings in the actual XF installer need to be adjusted as well as possibly the documentation and it would probably be good to inform existing customers actively and prominently as possibl many installs do use the default setting (hCaptcha w/o sitekey) and won't recognize automatically that registration is not working any more and even less what is the root cause and what possible solutions are.
 
Last edited:
This was a temporary issue with the service provider.
Seems indeed to work again right now. Is this free tier w/o registration key generally available or based on a kind of historical special agreement between XF and hCaptcha, as they do not seem to mention it at all on their site?
Nonetheless, we highly recommend considering an alternative provider such as Cloudflare Turnstile.
May I ask why?
 
Seems indeed to work again right now. Is this free tier w/o registration key generally available or based on a kind of historical special agreement between XF and hCaptcha, as they do not seem to mention it at all on their site?
It's a special agreement that they occasionally need to be reminded of :)

May I ask why?
1. I believe Turnstile to be the better product and it's unequivocally free without running the risk of hitting usage limits or pricing
2. * gestures towards every time it goes down *

At the very least, if you like hCaptcha, I recommend signing up for your own key so you're not at the mercy of our global one being blocked.
 
Back
Top Bottom