If you are an enterprise customer and would like to enable additional verification to be performed, you can optionally choose the following CSP strategy:

connect-src should include, Please do not hard-code specific subdomains, like, into your CSP: asset subdomains used may vary over time or by region.

If you use CSP headers, please add the following to your configuration: Your Server->User: Session authorized, proceedĬontent Security Policy (CSP) headers are an added layer of security that help to mitigate certain types of attacks, including Cross Site Scripting (XSS), clickjacking, and data injection attacks. HCaptcha Siteverify->Your Server: Passcode is valid (success is true) Your Server->hCaptcha Siteverify: Is this passcode valid? Your Website or App->Your Server: Form or XHR with hCaptcha passcode HCaptcha Client API->Your Website or App: Passcode embedded in form or returned via JS/callback HCaptcha Client API->User: Returns challenge or passcode User->hCaptcha Client API: Please issue passcode Your Website or App->User: Load hCaptcha JS or SDK User->Your Website or App: Load Website or App Your server now knows the user is not a bot and lets them log in. hCaptcha says it is valid and credits your account.

Your server then checks that passcode with the hCaptcha server API. When the user clicks Submit the passcode is sent to your server in the form. They get a passcode from our server that is embedded in your form.

You embed the hCaptcha widget on your site. Custom data attributes like theme, size, and tab-index are also supported in the same way by hCaptcha. hCaptcha methods are API-compatible with reCAPTCHA methods, for example render() and onload(). If you're already using Google's reCAPTCHA, you can use your existing code with a few slight changes. To make integration even quicker, wrappers and plugins are available for many frameworks: Angular, Node, Express, ReactJS, VueJS, WordPress and more.Ī complete list of known hCaptcha integrations is also available. It requires either adding some simple HTML and server side code, or using one of the many tools that natively support hCaptcha. The hCaptcha widget can protect your applications from bots, spam, and other forms of automated abuse.

2 captcha typing