The path to load recaptcha_ajax.js is hard-coded as:
drupal_set_html_head('<script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>');
(recaptcha.module line 154)

This causes a security warning in Chrome browsers. Not sure why only Chrome complains about this, no other browser seems to. This is a critical issue because it can cost sales when customers are not able to trust the security of a site's credit card processing because of browser security warnings.

Solution: change recaptcha_ajax.js script source to
https://www.google.com/recaptcha/api/js/recaptcha_ajax.js

...or possibly switch between http:// and https:// based on $_SERVER['HTTPS']).

Comments

mvc’s picture

Status: Active » Closed (duplicate)

no need to test; simpler for this to always be HTTPS

fixed in #1124950: reCAPTCHA uses a new HTTPS API URL