CAPTCHA

CAPTCHA asks a provider to decide whether a browser interaction looks human.

Use it when invisible controls are not enough. Start with Honeypot, rate limits, and email hygiene so legitimate visitors solve as few challenges as possible.

Choose a provider

• Cloudflare Turnstile is the privacy-oriented default.
• hCaptcha is useful when you already use its platform.
• Google reCAPTCHA supports checkbox and score-based flows.

Every provider gives you a public site key and a private secret. The site key belongs in the page. Save the secret only in Form Plume.

The browser sends a short-lived token with the form. Form Plume verifies it directly with the provider. Missing or definitively invalid tokens are rejected. Network, HTTP, and response-decoding failures fail open, as does Cloudflare Turnstile's retryable internal-error; the accepted submission is marked CAPTCHA-unverified, so keep the other spam layers enabled.