You’ve been running reCAPTCHA V3 for Jetpack long enough to know the drill. Invisible scoring, fewer form submissions from bots that can’t even pretend to act human, and the occasional reminder that the internet is still full of people (and scripts) with nothing better to do. Versions 1.23 of the free plugin and 1.6 of Pro clean up a few of the remaining rough edges.
Free Plugin 1.23
One of the more annoying problems was token expiration. Google’s reCAPTCHA v3 tokens only last about two minutes. If someone actually took their time writing a real message, the token that got generated when the page loaded was already dead by the time they hit send. Version 1.23 waits until the actual submit before asking for a fresh one. Legitimate people stop getting blocked just because they thought about what they were typing.
We also shut down the last of the cases where Jetpack was still firing off notification emails for submissions that never even had a token. Failed comments now land in the spam folder like the documentation always said they would, and the WooCommerce registration protection finally loads on the My Account page no matter which loading mode you’ve got selected.
What’s in 1.23
- Fresh token on every submit (no more expired-token false positives)
- Early stop on missing-token notification emails
- Failed comments go to the spam folder
- WooCommerce protection actually shows up when it’s supposed to
- Cleaner client IP handling
Pro 1.6
On the Pro side, the bigger fix is IPv6. A lot of the current botnet traffic rotates through large IPv6 blocks, and earlier versions could end up with incomplete or just plain wrong prefixes when the address used zero compression. 1.6 expands the full binary form first, then builds a proper /64. Those distributed attacks have a harder time sliding past the range bans now.
Banned IPs and ranges also get stopped earlier — before WordPress starts chewing on the form or the free plugin bothers Google. Less wasted work, fewer pointless API hits. The checks still run on the AJAX submissions Jetpack and WooCommerce actually use, while ignoring the usual background admin noise.
What’s in 1.6
- Properly expanded IPv6 range protection
- Earlier blocking of banned IPs and ranges
- AJAX handling that doesn’t break the forms people actually use
- Clearer view of who’s been banned and why
The free plugin still does the scoring, logging, and spam-folder work. Pro sits on top and handles the enforcement — blacklists, temporary bans, range protection. They’re meant to work together without getting in each other’s way.
If you’re already on the free plugin, grab 1.23. If you’re on Pro, 1.6 is worth the update. And if you’ve been thinking about adding the enforcement layer, this is as good a time as any.
Leave a Reply