Integrate hCaptcha widget and verify tokens with the siteverify API

Steps

1. Register an account at hcaptcha.com, create a site, and note your Site Key (public, used client-side) and Secret Key (private, used server-side only).
2. Load the hCaptcha widget script https://js.hcaptcha.com/1/api.js in your page and add a div with class h-captcha and data-sitekey=YOUR_SITE_KEY; on form submission the widget populates a hidden field named h-captcha-response with the token.
3. Submit the h-captcha-response token to your backend alongside any form data; validate on the server before processing the form.
4. From your backend, make a POST request to https://api.hcaptcha.com/siteverify with Content-Type application/x-www-form-urlencoded and body parameters secret=YOUR_SECRET_KEY and response=TOKEN; optionally include remoteip for additional signal.
5. Parse the JSON response: success: true means the token is valid; success: false means it is invalid, already used, or expired—inspect error-codes[] for the specific failure reason and reject the request accordingly.
6. Tokens are single-use and must be verified promptly; do not store or replay tokens.