Go toXenforo --> Admin --> Options --> Basic Options --> Enable CAPTCHA for guests
If you do not see Enable CAPTCHA for guests
Go footer and click display advanced options.
ErrorException: hCaptcha configuration error: invalid-input-secret
indicates that XenForo is receiving an invalid or incorrect secret key from hCaptcha. In other words, XenForo’s integration with hCaptcha is failing because the secret key on file does not match what hCaptcha expects.
Below are the most common causes and solutions:
1. Verify Your hCaptcha Credentials
1. Retrieve keys from the hCaptcha dashboard
• Go to hCaptcha.com (or dashboard.hcaptcha.com) and log in.
• In the dashboard, find the project/site for which you created your hCaptcha keys.
• Make sure you copy the Site Key and the Secret Key accurately.
2. Double-check for typos
• A single missing or extra character—especially hidden whitespace—can cause this error.
• Ensure the key in XenForo’s admin panel is exactly the same as in your hCaptcha dashboard.
3. Match the correct key fields
• In XenForo, there are two fields: Site Key and Secret Key.
• Ensure that your Site Key from hCaptcha is placed in the “Site Key” field, and your Secret Key is in the “Secret Key” field.
2. Confirm Domain Settings on hCaptcha
hCaptcha allows you to restrict usage of your site key and secret key to specific domains. If your forum domain is not listed or you’ve recently changed it (e.g., from example.com to www.example.com), it could cause a validation failure.
1. Check domain verification
• From your hCaptcha account, navigate to your site’s settings.
• Ensure the domain name (or wildcard, if you set it up that way) matches exactly the domain your XenForo installation is using (including www if relevant).
2. Update domain records if needed
• If you changed domains, add the new domain (or subdomain) in the hCaptcha settings.
• Save, and wait a few minutes for changes to propagate.
3. Confirm XenForo Captcha Settings
1. Navigate to the Captcha settings in XenForo
• In your XenForo Admin Panel, go to Setup → Options → Spam Management (depending on XenForo version, the path may vary slightly).
• Scroll to the Captcha options and select hCaptcha.
2. Enter (or re-enter) your credentials
• Paste your hCaptcha Site Key and Secret Key into their respective fields.
• Make sure there is no leading or trailing whitespace.
3. Save and test
• Hit save, then perform a quick test on your login, registration, or contact form to see if the Captcha renders and validates correctly.
4. Check for Conflicts or Add-Ons
Sometimes third-party XenForo add-ons or custom integrations that affect Captcha/spam settings can cause issues.
• Disable any third-party anti-spam add-ons temporarily to see if the hCaptcha error persists.
• If you recently installed a plugin that might override or hook into the Captcha system, disable or uninstall it, then test again.
5. Verify Server Communication
Even if your keys are correct, your web server must be able to make secure outbound requests to hCaptcha. Typically, this is not an issue, but you should check:
• Firewall or security settings: Ensure that calls to hCaptcha’s verification endpoint are allowed.
• cURL/allow_url_fopen: XenForo commonly uses cURL. Make sure cURL or equivalent is enabled in PHP and not blocked by server policy.
6. Regenerate the Secret Key (Last Resort)
If all else fails and you suspect the secret key might be compromised or incorrectly copied:
1. Generate a new secret key in your hCaptcha dashboard.
2. Update the key in XenForo.
3. Clear any caches (XenForo cache, CDN caches if applicable) and retest.
Common Pitfalls
• Accidental whitespace: Copying credentials from certain editors can include invisible whitespace or newline characters. Double-check or type them manually if needed.
• Wrong environment or domain: If your forum has multiple environments (e.g., staging vs. production), make sure you’re using the correct set of keys.
• DNS propagation: If you changed your domain name or DNS settings very recently, it might take some time before everything syncs with hCaptcha domain restrictions.
Conclusion
The invalid-input-secret error nearly always means the secret key in XenForo does not match what hCaptcha expects (because it’s incorrect, expired, or does not match the authorized domain). By re-verifying and carefully copying the correct keys—and ensuring that your hCaptcha settings match your actual forum domain—this error should be resolved.
Once you have the correct Site Key and Secret Key entered in your XenForo Captcha settings and your domain is properly set up in the hCaptcha dashboard, the invalid-input-secret error should disappear and hCaptcha will function as intended.
If you do not see Enable CAPTCHA for guests
Go footer and click display advanced options.
ErrorException: hCaptcha configuration error: invalid-input-secret
indicates that XenForo is receiving an invalid or incorrect secret key from hCaptcha. In other words, XenForo’s integration with hCaptcha is failing because the secret key on file does not match what hCaptcha expects.
Below are the most common causes and solutions:
1. Verify Your hCaptcha Credentials
1. Retrieve keys from the hCaptcha dashboard
• Go to hCaptcha.com (or dashboard.hcaptcha.com) and log in.
• In the dashboard, find the project/site for which you created your hCaptcha keys.
• Make sure you copy the Site Key and the Secret Key accurately.
2. Double-check for typos
• A single missing or extra character—especially hidden whitespace—can cause this error.
• Ensure the key in XenForo’s admin panel is exactly the same as in your hCaptcha dashboard.
3. Match the correct key fields
• In XenForo, there are two fields: Site Key and Secret Key.
• Ensure that your Site Key from hCaptcha is placed in the “Site Key” field, and your Secret Key is in the “Secret Key” field.
2. Confirm Domain Settings on hCaptcha
hCaptcha allows you to restrict usage of your site key and secret key to specific domains. If your forum domain is not listed or you’ve recently changed it (e.g., from example.com to www.example.com), it could cause a validation failure.
1. Check domain verification
• From your hCaptcha account, navigate to your site’s settings.
• Ensure the domain name (or wildcard, if you set it up that way) matches exactly the domain your XenForo installation is using (including www if relevant).
2. Update domain records if needed
• If you changed domains, add the new domain (or subdomain) in the hCaptcha settings.
• Save, and wait a few minutes for changes to propagate.
3. Confirm XenForo Captcha Settings
1. Navigate to the Captcha settings in XenForo
• In your XenForo Admin Panel, go to Setup → Options → Spam Management (depending on XenForo version, the path may vary slightly).
• Scroll to the Captcha options and select hCaptcha.
2. Enter (or re-enter) your credentials
• Paste your hCaptcha Site Key and Secret Key into their respective fields.
• Make sure there is no leading or trailing whitespace.
3. Save and test
• Hit save, then perform a quick test on your login, registration, or contact form to see if the Captcha renders and validates correctly.
4. Check for Conflicts or Add-Ons
Sometimes third-party XenForo add-ons or custom integrations that affect Captcha/spam settings can cause issues.
• Disable any third-party anti-spam add-ons temporarily to see if the hCaptcha error persists.
• If you recently installed a plugin that might override or hook into the Captcha system, disable or uninstall it, then test again.
5. Verify Server Communication
Even if your keys are correct, your web server must be able to make secure outbound requests to hCaptcha. Typically, this is not an issue, but you should check:
• Firewall or security settings: Ensure that calls to hCaptcha’s verification endpoint are allowed.
• cURL/allow_url_fopen: XenForo commonly uses cURL. Make sure cURL or equivalent is enabled in PHP and not blocked by server policy.
6. Regenerate the Secret Key (Last Resort)
If all else fails and you suspect the secret key might be compromised or incorrectly copied:
1. Generate a new secret key in your hCaptcha dashboard.
2. Update the key in XenForo.
3. Clear any caches (XenForo cache, CDN caches if applicable) and retest.
Common Pitfalls
• Accidental whitespace: Copying credentials from certain editors can include invisible whitespace or newline characters. Double-check or type them manually if needed.
• Wrong environment or domain: If your forum has multiple environments (e.g., staging vs. production), make sure you’re using the correct set of keys.
• DNS propagation: If you changed your domain name or DNS settings very recently, it might take some time before everything syncs with hCaptcha domain restrictions.
Conclusion
The invalid-input-secret error nearly always means the secret key in XenForo does not match what hCaptcha expects (because it’s incorrect, expired, or does not match the authorized domain). By re-verifying and carefully copying the correct keys—and ensuring that your hCaptcha settings match your actual forum domain—this error should be resolved.
Once you have the correct Site Key and Secret Key entered in your XenForo Captcha settings and your domain is properly set up in the hCaptcha dashboard, the invalid-input-secret error should disappear and hCaptcha will function as intended.
