FitMyKB Verify
Keep your h-captcha markup, hcaptcha calls and siteverify code. Most visitors tick one box instead of solving pictures, and every plan gets a score.
On hCaptcha's free Basic plan most visitors get a picture challenge (hCaptcha's own FAQ says so), and the score is for Enterprise only. Pro is US$99 a month for 100,000. With FitMyKB Verify most people tick one box while their browser does a small proof-of-work, and only suspicious visitors see a puzzle.
The widget reads class="h-captcha" boxes and their data- attributes, and window.hcaptcha keeps render, execute, reset and getResponse. The form keeps sending h-captcha-response.
<!-- Before: hCaptcha -->
<script src="https://js.hcaptcha.com/1/api.js" async defer></script>
<div class="h-captcha" data-sitekey="HCAPTCHA_SITE_KEY" data-callback="onHuman"></div>
<!-- After: keep the markup, change the script and the key -->
<script src="https://captcha.fitmykb.com/api.js" async defer></script>
<div class="h-captcha" data-sitekey="YOUR_SITE_KEY" data-callback="onHuman"></div>
<script>
// hcaptcha.render, execute, reset and getResponse keep working
const id = hcaptcha.render("captcha-box", { sitekey: "YOUR_SITE_KEY" });
</script>Post secret and response to our siteverify address instead of api.hcaptcha.com. The reply has success, hostname, challenge_ts and error-codes as before, plus a score from 0 to 1 on every plan.
// Your server: only the address and the secret change. Same request, same reply fields.
// Before
$url = 'https://www.google.com/recaptcha/api/siteverify'; // or https://api.hcaptcha.com/siteverify
$secret = getenv('RECAPTCHA_SECRET');
// After
$url = 'https://captcha.fitmykb.com/siteverify';
$secret = getenv('FMK_SECRET');
$reply = json_decode(file_get_contents($url, false, stream_context_create(['http' => [
'method' => 'POST', 'timeout' => 5,
'header' => 'Content-Type: application/x-www-form-urlencoded',
'content' => http_build_query(['secret' => $secret, 'response' => $_POST['g-recaptcha-response'] ?? '']),
]])), true);
// $reply['success'], $reply['score'] (0 to 1), $reply['hostname'], $reply['challenge_ts'], $reply['error-codes']When a puzzle is needed you pick the style: slide, rotate, tap, picture grid or a mix, drawn fresh for every visitor so there's no fixed image set to train a bot on. Or ask for a puzzle every time on sensitive pages.
Test on localhost or staging while the new website is in test mode, then deploy the new script and secret together.
Yes: data-callback, data-expired-callback and data-error-callback, and the same options in hcaptcha.render.
Yes. If hCaptcha's own script is on a page, window.hcaptcha stays theirs; use fmkcaptcha on that page.