# hCaptcha

Add hCaptcha to a Form Plume form: create an hCaptcha site, save your site key and secret, then drop in the widget so submissions get server-side verification.

hCaptcha gives your form a visible challenge backed by server-side verification. See [CAPTCHA](/docs/spam-protection/captcha) for how Form Plume decides when to show a challenge.

hCaptcha suits forms that want a visible, privacy-focused challenge; for an invisible check see [Cloudflare Turnstile](/docs/spam-protection/captcha/turnstile).

## 1. Create the site

Create a site in hCaptcha and add the domains that contain your form. Copy its site key and secret.

## 2. Save the keys

Open **Spam protection**, choose **hCaptcha**, and save both values. Keep the secret out of your HTML and JavaScript.

## 3. Add the widget

```html
<script src="https://js.hcaptcha.com/1/api.js" async defer></script>

<div class="h-captcha" data-sitekey="YOUR_SITE_KEY"></div>
```

hCaptcha adds `h-captcha-response` to the form. Form Plume sends that token to hCaptcha before accepting the submission.

Send a real test from the published page after enabling it.