> Source: [sk183960](https://support.checkpoint.com/results/sk/sk183960)

# sk183960 - Google reCAPTCHA fails to load when UserCheck is not enabled on the cleanup rule

| Property | Value |
|----------|-------|
| Solution ID | sk183960 |
| Date Created | 2025-09-12 |
| Last Modified | 2025-09-15 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Google reCAPTCHA and related Google services fail to load when UserCheck is not enabled on the cleanup rule. When UserCheck is enabled on the cleanup rule, Google reCAPTCHA and related Google services function as expected.

* Browsers display errors such as:   

  * *www.google.com didn't send any data. ERR_EMPTY_RESPONSE* in Google Chrome
  * *Secure Connection Failed* in Mozilla Firefox

  when attempting to access reCAPTCHA without UserCheck.
* Allowing traffic to and from google.com in the Access Control policy resolves the issue, but it is not recommended for security reasons.

* The issue only occurs when the Security Gateway is configured as a proxy with HTTPS Inspection enabled.

## Cause

The issue is related to how the Security Gateway processes HTTPS CONNECT requests when acting as a proxy. When a client initiates a connection to a site such as google.com/recaptcha, the initial CONNECT request contains only the destination domain (google.com), not the full Uniform Resource Locator (URL) path. The security policy evaluates this initial request, and if only google.com/recaptcha is allowed (not google.com), the connection is blocked because the full path is not visible at this stage.  

When UserCheck is enabled, the Request for Comments (RFC) standard prevents redirection at the CONNECT stage, allowing the connection to proceed. This enables the Security Gateway to inspect the full URL and permit access to Google reCAPTCHA. Without UserCheck, the Security Gateway cannot see the full URL during the CONNECT stage and blocks the request. This behavior is a limitation of proxy and RFC standards in combination with Check Point policy enforcement.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content