I think I found the reason this doesn't work while looking at the Recaptcha Admin console by Google.

For every captcha configuration there is this setting called Verify the origin of reCAPTCHA solutions

Description:

If disabled, you are required to check the hostname on your server when verifying a solution.

If we would uncheck that setting, I think it would work again BUT would also be a security risk because then the captcha key can be used anywhere, not only on our sites: https://developers.google.com/recaptcha/docs/domain_validation#security_warning

So I think we can:

• look at how mediawiki is validating the request and add hostname verification "somehow",
• or be okay with that security risk. (at this point I'm not sure I understand the impact enough, could be rather insignificant but it seems somewhat important to Google)

thank you for adding what you found @Deniz_WMDE

I found this answer on stack exchange about why domain validation is a major security issue for recaptcha. https://security.stackexchange.com/questions/149324/why-bother-validating-the-hostname-for-a-google-recaptcha-response

It may have something to do with people embedding your captchas on a site they set up, and using the solved captchas to spam your site.

so we probably want to go with the first bullet point Deniz made in his comment.

@Addshore mentioned that on WBStack this box was already ticked (i.e. domain validation was disabled)

We probably could therefore in the short term also click this; this does expose us to slightly more risk of spam as per the links.

In the medium to long term we would probably like to properly resolve this. We could do this either by implementing checking the host in all the places we use recaptcha or we could automatically create (or update) the existing recaptcha details to add all the custom domain wikis that we have.

We also could certainly generate a new pair just for use by the custom domains rather than the wikibase.cloud ones. This would reduce the exposure of flipping this switch.

After talking with other devs we went with the 2nd bullet point (changed the recaptcha setting to not validate domains.) We changed the setting on both staging and production.

appears to be fixed to me!

Stunning, fixed indeed! Gracias @Rosalie_WMDE
@Valerie_Wollinger_WMDE FYI - you can inform the people that this is now fixed (https://data.r74n.com/w/index.php?title=Special:CreateAccount)