Here is an excerpt from code from Google's recaptcha API (https://www.google.com/recaptcha/api.js):

(function() {
    if (!window['___grecaptcha_cfg']) { 
        window['___grecaptcha_cfg'] = {}; 
    if (!window['___grecaptcha_cfg']['render']) { 
        window['___grecaptcha_cfg']['render'] = 'onload'; 
    window['__google_recaptcha_client'] = true;
    var po = document.createElement('script'); 
    po.type = 'text/javascript'; 
    po.async = true;
    po.src = 'https://www.gstatic.com/recaptcha/api2/r20160314182818/recaptcha__it.js';
    var s = document.getElementsByTagName('script')[0];
    s.parentNode.insertBefore(po, s);

Why does Google recommend not to copying and pasting this code? Is it because they would lose tracking information?

I think that the code inserts a script on the page. To avoid another connection it would be useful to copy and paste the code directly. Is this ok?

  • 13
    If I were to guess, I'd say that they're saying "Instead of pasting this code into your page, source it from the API url instead so that, if we change it, your page will automatically pick up the changes." Mar 23, 2016 at 14:58
  • 2
    There is some irony in you copying and pasting the code here Dec 9, 2016 at 22:28

1 Answer 1


Note the po.src line: r20160314182818 looks to be a timestamp, so in this case it's probably giving you the version that was deployed on 3/14/2016 at 6:28:18 PM.

I suspect that the it bit means you are getting the Italian version, which means you are getting a version of api.js based on your physical location. Your profile mentions you are Italian, so I taken this as confirmation.

Note that when I follow the link above from California, that line looks like this:

 po.src = 'https://www.gstatic.com/recaptcha/api2/r20160314182818/recaptcha__en.js'

What this means in general is that Google is deploying changes to this API very often (given that the deployed version is only nine days old) and based on the user's location. This is likely done because captchas are a direct target for reverse engineering by people looking to automate whatever process the captcha protects and because captchas may have culturally significant features.

If you copy paste this code, it means:

  1. You will be using a frozen codebase, and therefore not get any benefit of any changes Google might make.
  2. You are forcing users worldwide to use a version meant for a particular locale. Perhaps your Japanese users will have problems with captchas designed for Italians.
  3. If Google decides to remove that particular revision, your code will completely break.

When using any API, it is very important to always stick to the public API and never use anything private for reasons such as this.

Not the answer you're looking for? Browse other questions tagged or ask your own question.