Captcha verification failed
The site asked the captcha provider to verify a token and the check failed (400). Common on download grant and comment posting when captcha is fully configured.
Why this happens
Token missing, expired, wrong secret, clock skew, or the visitor failed/ignored the widget. Unlike the “not configured” soft warning, here keys exist and verification is enforced.
Diagnose and fix
1. Visitor: complete the captcha again (refresh if the widget timed out).
2. Admin: confirm Captcha provider + matching keys; test with a private window.
3. Download: Download captcha tier toggles. Comments: Captcha on comments (comment_captcha_enabled).
4. Check provider dashboards for invalid-secret / domain mismatches.
5. Rate limits: Captcha attempts per hour if someone is hammering failed solves.