Signup doesn't work when hCaptcha enabled and keys not configured

AI-generated summary

The discussion revolves around an issue where users cannot sign up on a Discourse instance when the hCaptcha plugin is enabled but not properly configured with valid keys. martinmodrak initially reported the problem, noting that users encountered an error message: “There has been a problem with hCaptcha…” — resolved only by disabling the plugin. It was later clarified by martinmodrak that the plugin was mistakenly enabled by another admin, not by default. tobiaseigen confirmed that hCaptcha is not enabled by default on official hosting, but once enabled, the discourse hcaptcha enabled setting is automatically turned on — without warnings if keys are missing or invalid. This leads to a broken signup flow with no clear guidance for admins. tobiaseigen added screenshots showing the error and noted that while a warning about invalid keys appears on the admin dashboard, it may not be prominent enough. A pull request was submitted and merged to improve guidance in site settings to prevent this misconfiguration in the future tobiaseigen.

It appears that on our (officially hosted) instance, hCaptcha plugin was turned on by default, but (for obvious reasons) was not configured with a hCaptcha account. We just had a user report that they couldn’t sign up and got the message:

There has been a problem with hCaptcha, if this problem persists please contact a system administrator

Turning hCaptcha plugin off seems to resolve the problem.
It is unclear how many users were affected as without signing up, users must find a side channel to contact us. So just noting for other admins.

The hCaptcha plugin is not enabled by default, or it should not be!

Can you check in your staff action logs to see when the plugin was enabled on your site?

Oh sorry, didn’t check properly, it was actually done by another admin, so that’s on us.

Cool! Glad to see this isn’t a widespread problem. :sweat_smile:

I did just have a closer look and can confirm that on my site, the discourse hcaptcha enabled site setting is not selected by default which is correct. The plugin is not enabled by default on our hosting (or at least on the starter plan I just tested). However, when you enable the plugin, the discourse hcaptcha enabled setting is enabled already.

So this does seem to be a case where site owners can shoot themselves in the foot accidentally and without any warning in the admin interface. If you enable the plugin and then enable discourse hcaptcha enabled, but don’t provide the keys (or provide incorrect keys), no warning is shown in the interface. There is also no guidance on how to get an hCaptcha account.

Instead, an error is shown on the signup form and it’s impossibel to sign up.

I made a pull request to add some more guidance on the site settings to help others avoid this situation. Edit: merged.

Also noticed that there is a warning that should have been displayed on your admin home page to let you know there is a problem with your hCaptcha config. I guess it was not prominent enough?

There is a problem with your hCaptcha site_key or secret_key configuration