Seeing a “security check fail” message when someone tries to submit your Wholesale Registration Form? This usually comes down to caching serving a stale security token, or a reCAPTCHA misconfiguration. This article walks you through both causes so you can get the form working again. The form is part of WooCommerce Wholesale Lead Capture.
The form shows a security check fail after caching
What’s happening
Customers see a “security check fail” message when they submit the Wholesale Registration Form, and the registration does not go through.
Why it happens
A caching layer is serving an outdated nonce or token for the form, which breaks validation when the form is submitted. The cache can come from a caching plugin, your host’s server-level caching, or your own browser.
How to fix it
Exclude the Wholesale Registration page from your caching plugin’s rules, or temporarily deactivate the plugin to confirm it is the cause. If you are not sure where the exclusion setting is, deactivating the plugin and retesting is the fastest check.
If your host applies server-level caching, contact your hosting provider and ask them to exclude the Wholesale Registration page from their caching rules. WPEngine, Flywheel, and Kinsta are common managed hosts that cache at the server level.
When you retest, clear your browser cache or open the form in a private or incognito window so stored browser data does not affect the result.
Configure reCAPTCHA correctly
The “security check fail” error is sometimes a reCAPTCHA failure, not a nonce failure. If you’ve enabled reCAPTCHA on the registration form, check the configuration before assuming the form is broken.
Go to WooCommerce → Settings → Wholesale Lead → Security. Confirm the following:
- Enable Recaptcha is on.
- reCAPTCHA type matches the keys you generated in the Google Cloud reCAPTCHA console (V2 I’m not a robot, V2 Invisible, or V3 Score-based).
- Recaptcha site key and Recaptcha secret key are filled in and match the type you selected. Mismatched keys (e.g. a v2 site key with v3 selected) silently fail verification.
If you’re using v3 Score-based and legitimate users get rejected
v3 returns a confidence score between 0.0 and 1.0 for every submission. The plugin rejects scores below the configured threshold. The default threshold is 0.5, which is sometimes too strict for stores with regular sign-ups from VPN users or shared offices.
Lower the Recaptcha v3 score threshold to 0.3 or 0.4 and ask the affected user to register again. If the registration goes through at the lower threshold, that’s the cause.
v3 also checks that the form’s action label matches the expected action (wwlc_register for registration, wwlc_login for login). If you’ve customised the form templates and changed those action names, reCAPTCHA will reject every submission. Restore the default action names or update them in your custom integration to match.
Frequently asked questions
How do I exclude the wholesale registration page from caching?
To do this, open your caching plugin’s settings and add that page’s URL to its exclusion list. If the option is hard to find, temporarily deactivate the plugin and retest the form.
Does the security check error occur on WPEngine or Kinsta hosting?
Yes, managed hosts like WPEngine, Flywheel, and Kinsta apply server-level caching that can trigger this error. Contact your host and ask them to exclude that form page from their caching configuration.
What if disabling every cache layer still doesn’t fix it?
If cache adjustments don’t resolve the problem, get in touch with the Wholesale Suite support team. Share your hosting environment, active plugins, and troubleshooting steps taken so they can identify the root cause.
Can I use incognito mode to diagnose a security check failure?
Loading the form in private browsing is a fast way to rule out stored browser data as the cause. If it passes in incognito but fails normally, clear your cookies and cached files, then retry.
Why does the wholesale registration form keep failing security checks?
Typically, a caching mechanism is saving an outdated nonce or token for your form, which breaks validation. Removing that page from all cache rules, plugin, server, and browser, usually resolves it.
Need help?
If you have a question or run into any issues, we’re here to help.
- Premium users: Open a support ticket
- Free users: Visit our community forum
