This error comes from Google. When someone submits a UsersWP form, the ReCaptcha add-on sends their answer to Google along with your secret key. Google replies with this error when the secret key it receives is empty or does not match a valid key pair. In most cases the keys need fixing.

Check the keys

1. Open the reCAPTCHA admin console in your Google account and find the key pair for this site. Note its type: reCAPTCHA v2 (the “I’m not a robot” checkbox or the invisible badge) or reCAPTCHA v3.
2. Go to UsersWP > Addons > ReCaptcha and choose the same version. Keys made for v2 do not work with the v3 setting, and v3 keys do not work with v2.
3. Copy the site key and the secret key again and paste them into the matching fields, with no spaces before or after. A site key pasted into the secret key field gives this exact error.
4. In the Google console, check that your domain is in the list of domains for that key. Add it if you moved the site or use a different domain.
5. Save, clear any page cache and test the form in a private browser window.

Another plugin also loads reCAPTCHA

If a contact form, security plugin or your theme adds reCAPTCHA to the same pages, the two can clash, especially when one uses v2 and the other v3. The error then often shows on the first submit, or only on pages where both forms appear. Either use the same reCAPTCHA version and key pair in both plugins, or turn off the other plugin’s reCAPTCHA on the login and register forms so only UsersWP adds it there.

The first try fails and the second works

A reCAPTCHA v3 token is only valid for two minutes. If a visitor opens the login or register lightbox and waits before submitting, Google can reject the first attempt. Closing and reopening the form creates a new token, which is why the second attempt works.

For the full setup steps, see the ReCaptcha Setup Guide and Settings Overview for UsersWP > Addons > ReCaptcha.