Seeing a “Security check fail” message when someone submits your Wholesale Registration Form? The usual causes are a cache serving an outdated security token, or a reCAPTCHA setup that does not match your keys. This guide walks you through both, so you can get registrations coming in again. The form is part of WooCommerce Wholesale Lead Capture.
The form shows a security check fail after caching
What’s happening
Customers see a “Security check fail” message when they submit the Wholesale Registration Form, and the registration does not go through.
Why it happens
A caching layer is serving an outdated security token for the form, which breaks validation when the form is submitted. The cache can come from a caching plugin, your host’s server-level caching, or your own browser.
How to fix it
Exclude the Wholesale Registration page from your caching plugin’s rules, or temporarily deactivate the plugin to confirm it is the cause. If you’re not sure where the exclusion setting is, deactivating the plugin and retesting is the fastest check.
If your host applies server-level caching, contact your hosting provider and ask them to exclude the Wholesale Registration page from their caching rules. WP Engine, Flywheel, and Kinsta are common managed hosts that cache at the server level.
When you retest, clear your browser cache or open the form in a private or incognito window so stored browser data does not affect the result.
The form shows a security check fail when reCAPTCHA is on
What’s happening
You have turned on reCAPTCHA for the registration form. Customers complete the form, and the same “Security check fail” message appears.
Why it happens
When reCAPTCHA is on, the plugin asks Google to verify each submission. If your keys don’t match the reCAPTCHA type you selected, or a v3 score falls below your threshold, verification fails and the form shows the same message as a caching problem.
How to fix it
Open the reCAPTCHA settings:
- In your WordPress admin, go to Wholesale → Settings.
- Click the Wholesale Lead Capture tab.
- Click Security.
Then confirm the following:
- Enable Recaptcha is checked.
- reCAPTCHA type matches the keys you generated in the Google Cloud reCAPTCHA console. The three options are V2 I’m not a robot, V2 Invisible, and V3 Score-based.
- Recaptcha site key and Recaptcha secret key are filled in and belong to the type you selected. Mismatched keys, for example a v2 site key with v3 selected, fail verification without any other warning.
Click Save Changes after you make a change, then test the form again.
If the settings are correct and the form still fails, check whether another plugin blocks the reCAPTCHA script. Optimization plugins that delay or combine JavaScript, and some cookie consent plugins, can stop the script from loading. The form then sends no reCAPTCHA response, and the security check fails. Exclude the reCAPTCHA script (google.com/recaptcha) in that plugin, then test the form again.
On older versions of WooCommerce Wholesale Lead Capture (1.17.7.1 and earlier), the same settings are under WooCommerce → Settings → Wholesale Lead → Security. On newer versions, that old address sends you to the Wholesale Lead Capture settings instead.
If you’re using V3 Score-based and genuine customers get rejected
v3 gives every submission a confidence score between 0.0 and 1.0. The plugin rejects scores below your threshold. The default threshold is 0.5, which can be too strict for stores with regular sign-ups from VPN users or shared offices.
Lower the Recaptcha v3 score threshold to 0.3 or 0.4, save, and ask the affected customer to register again. If the registration goes through at the lower threshold, the score was the cause.
v3 also checks the action name the form sends with each submission. For registration, the plugin expects wwlc_register. If custom code changes that action name, every registration fails the check, so restore the default name.
Frequently asked questions
How do I exclude the wholesale registration page from caching?
Open your caching plugin’s settings and add that page’s URL to its exclusion list. If the option is hard to find, temporarily deactivate the plugin and retest the form.
Does the security check error occur on WP Engine or Kinsta hosting?
It can. Managed hosts like WP Engine, Flywheel, and Kinsta apply server-level caching that can trigger this error. Contact your host and ask them to exclude the registration page from their caching configuration.
Where are the reCAPTCHA settings?
Go to Wholesale → Settings → Wholesale Lead Capture → Security. Older versions of WooCommerce Wholesale Lead Capture keep them under WooCommerce → Settings → Wholesale Lead → Security.
What if disabling every cache layer still doesn’t fix it?
Get in touch with the Wholesale Suite support team. Share your hosting environment, your active plugins, and the steps you have already tried so the team can find the cause.
Can I use incognito mode to diagnose a security check failure?
Yes. Loading the form in private browsing is a fast way to rule out stored browser data. If it passes in incognito but fails normally, clear your cookies and cached files, then retry.
Need help?
If you have a question or run into any issues, we’re here to help.
- Premium users: Open a support ticket
- Free users: Visit our community forum
