Set up hCaptcha

Privacy-focused captcha that works as a drop-in alternative to reCAPTCHA.

What is hCaptcha?

hCaptcha is an independent captcha service that protects forms from bots without relying on Google. It works similarly to reCAPTCHA v2 — users see a checkbox, and sometimes a visual challenge — but with a key difference: hCaptcha does not use Google cookies or tracking. User data stays with hCaptcha (based in the US with GDPR-compliant processing) and is not fed into an advertising network.

This makes hCaptcha the preferred choice for sites that need to comply with strict privacy regulations or simply want to avoid Google's data collection practices.

Why choose hCaptcha?

Privacy-first — no Google tracking cookies. Better for GDPR, ePrivacy, and user trust.
Free for most use cases — the free tier covers up to 1 million verifications per month, which is more than enough for most websites.
Drop-in replacement — if you are switching from reCAPTCHA v2, the integration is nearly identical. Same checkbox UX, similar API.
Accessibility support — hCaptcha includes an accessibility option that lets visually impaired users complete verification without image challenges.
Works globally — unlike reCAPTCHA, hCaptcha is not blocked in countries that restrict Google services.

Step 1: Create an hCaptcha account and get your keys

Go to dashboard.hcaptcha.com/signup and create a free account.
After signing in, click New Site to register your website.
Enter your domain name (e.g., yoursite.com). Also add formblade.com if you use the hosted form page.
Copy the Site Key from the site configuration page.
Go to Settings in the top navigation menu and copy your account Secret Key.

Tip: hCaptcha provides a test site key 10000000-ffff-ffff-ffff-000000000001 and test secret key 0x0000000000000000000000000000000000000000 that always pass verification. Use these during development.

Step 2: Add keys in FormBlade

Open your form in the FormBlade dashboard.
Go to the Settings tab.
Scroll down to the Captcha section.
Select hCaptcha from the dropdown.
Paste your Site Key into the Site Key field.
Paste your Secret Key into the Secret Key field.
Click Save.

If you use a hosted form, the hCaptcha widget is added automatically. If you use a custom HTML form, you need to add the widget code yourself (see below).

How hCaptcha works

When a user loads your form, they see a compact checkbox widget. Clicking it starts verification. In many cases the check completes instantly. If hCaptcha detects suspicious behavior, it shows an image challenge (e.g., "select the images containing a bicycle"). Once completed, a hidden h-captcha-response field is added to the form. FormBlade verifies this token server-side using your Secret Key before accepting the submission.

Add hCaptcha to a custom HTML form

If you are not using a hosted form, add the hCaptcha script and widget div to your page:

<script src="https://js.hcaptcha.com/1/api.js" async defer></script>

<form action="https://formblade.com/f/contact" method="POST">
  <label>Name</label>
  <input type="text" name="name" required>

  <label>Email</label>
  <input type="email" name="email" required>

  <label>Message</label>
  <textarea name="message" required></textarea>

  <!-- hCaptcha widget -->
  <div class="h-captcha" data-sitekey="YOUR_SITE_KEY"></div>

  <button type="submit">Send</button>
</form>

Replace /f/contact with your own form link from the dashboard.

Replace YOUR_SITE_KEY with your actual site key from the hCaptcha dashboard. The widget renders the checkbox automatically. When the user completes verification, a hidden h-captcha-response field is injected into the form.

AJAX submission with hCaptcha

If you submit your form with JavaScript (fetch or XMLHttpRequest), make sure you include the hCaptcha response token:

<script src="https://js.hcaptcha.com/1/api.js" async defer></script>

<form id="myForm" action="https://formblade.com/f/contact" method="POST">
  <input type="text" name="name" required>
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <div class="h-captcha" data-sitekey="YOUR_SITE_KEY"></div>
  <button type="submit">Send</button>
</form>

<script>
document.getElementById('myForm').addEventListener('submit', async function(e) {
  e.preventDefault();
  const res = await fetch(this.action, {
    method: 'POST',
    body: new FormData(this),
  });
  if (res.ok) {
    this.innerHTML = '<p>Thank you!</p>';
  }
});
</script>

Replace /f/contact with your own form link from the dashboard.

The h-captcha-response field is included in the FormData automatically after the user completes the widget.

Tips

Best for EU/GDPR sites — if you need to avoid Google services for privacy reasons, hCaptcha is the go-to checkbox captcha. It is GDPR-compliant out of the box.
Free for most use cases — the free tier includes 1 million verifications per month with no credit card required. Most websites never come close to this limit.
Accessibility mode — hCaptcha offers a cookie-based accessibility option at hcaptcha.com/accessibility for users with visual impairments. They register once and skip image challenges going forward.
Works where Google is blocked — in countries or corporate networks that block Google services, hCaptcha still works because it uses its own infrastructure.
Combine with honeypot — FormBlade's honeypot protection still runs even when hCaptcha is enabled, giving you two layers of bot protection.

Troubleshooting

Captcha widget not loading

If the hCaptcha checkbox does not appear:

Check that the api.js script tag is present and loading (no errors in the browser's Network tab).
Verify that the domain serving your form is listed in your hCaptcha site configuration. The domain must match exactly.
Make sure no ad blocker or privacy extension is blocking js.hcaptcha.com. Some aggressive blockers filter captcha scripts.

Rate limiting errors

If users see rate limit errors from hCaptcha, it usually means:

The same IP is sending too many verification requests in a short period. This can happen during testing — wait a few minutes and try again.
Your site key is misconfigured. Verify the key in your hCaptcha dashboard matches what is in your HTML and FormBlade settings.

Submissions failing with captcha error

Double-check that you pasted the Secret Key (not the Site Key) into the Secret Key field in FormBlade. The two keys serve different purposes and are not interchangeable.