Keys
Create a free account, add your website and copy the site key and secret. Keep both out of your code: environment variables, or a config file outside the web root.
FitMyKB Verify
Add a CAPTCHA to a PHP form
No library and no Composer: place the box in your form and check the token with one HTTP call before you send the e-mail or save the data.
The form and the check
The widget puts a one-time token in the form as fmk-captcha-response. Before doing anything with the message, post it to siteverify with your secret. A token works once, for two minutes, so a bot can't reuse one.
<?php
// contact.php: the form and its check in one file. FMK_SITE_KEY and FMK_SECRET come from the environment.
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$reply = json_decode((string) @file_get_contents('https://captcha.fitmykb.com/siteverify', false, stream_context_create(['http' => [
'method' => 'POST', 'timeout' => 5,
'header' => 'Content-Type: application/x-www-form-urlencoded',
'content' => http_build_query(['secret' => getenv('FMK_SECRET'), 'response' => $_POST['fmk-captcha-response'] ?? '']),
]])), true);
if (empty($reply['success'])) {
$error = 'Please tick the box to show you are human.';
} else {
// Send the e-mail or save the message here, then redirect.
header('Location: /thanks'); exit;
}
}
?>
<form method="post">
<input name="email" type="email" required>
<textarea name="message" required></textarea>
<div class="fmk-captcha" data-sitekey="<?= htmlspecialchars(getenv('FMK_SITE_KEY')) ?>"></div>
<?php if ($error): ?><p role="alert"><?= htmlspecialchars($error) ?></p><?php endif; ?>
<button>Send</button>
</form>
<script src="https://captcha.fitmykb.com/api.js" async defer></script>Hosts without allow_url_fopen
Some shared hosts block file_get_contents for web addresses. The cURL version does the same check and lets you decide what happens if our server can't be reached.
// The same check with cURL, for hosts that turn off allow_url_fopen
function fmk_human(string $token): bool {
$curl = curl_init('https://captcha.fitmykb.com/siteverify');
curl_setopt_array($curl, [
CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 5,
CURLOPT_POSTFIELDS => http_build_query(['secret' => getenv('FMK_SECRET'), 'response' => $token]),
]);
$body = curl_exec($curl);
curl_close($curl);
if ($body === false) return true; // FitMyKB unreachable: let people in (or return false to block)
return !empty(json_decode($body, true)['success']);
}Old PHP CAPTCHAs
Distorted-text images drawn with GD are easy for today's text-reading software, and they make people squint. A proof-of-work check costs bots real computing time and asks most people for one tick.
Test it
Submit the form without ticking the box: you get the error. Tick it and send: the message goes through. Then ask for the website to go live from your dashboard.