FitMyKB Verify
Keep your g-recaptcha markup, grecaptcha calls and server check. Change the script, the keys and the verify address, and your forms stop sending visitors' data to Google.
reCAPTCHA's free tier is 10,000 assessments a month shared by all your sites, then US$8 a month and US$1 per 1,000 above 100,000. It also runs Google's script on your forms. FitMyKB Verify sets no cookies, builds no advertising profile, and its Starter plan covers 250,000 checks for ₹99 (US$2.99) a month on launch offer.
Keep the g-recaptcha box and its data- attributes, including data-callback. Swap Google's script for ours and put in your FitMyKB site key. The form keeps sending g-recaptcha-response, so nothing else on the page changes.
<!-- Before: reCAPTCHA v2 -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<div class="g-recaptcha" data-sitekey="RECAPTCHA_SITE_KEY" data-callback="onHuman"></div>
<!-- After: the same box, a new script and your FitMyKB site key -->
<script src="https://captcha.fitmykb.com/api.js" async defer></script>
<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY" data-callback="onHuman"></div>
<!-- The form still gets g-recaptcha-response (and fmk-captcha-response). -->Load api.js with ?render= and your site key. grecaptcha.ready and grecaptcha.execute work as before, and nobody sees a box. Your server gets a score from 0 to 1 and the action name, just like v3.
<!-- Before: reCAPTCHA v3 -->
<script src="https://www.google.com/recaptcha/api.js?render=RECAPTCHA_SITE_KEY"></script>
<!-- After: score only, nothing shown to people -->
<script src="https://captcha.fitmykb.com/api.js?render=YOUR_SITE_KEY"></script>
<script>
grecaptcha.ready(() => {
grecaptcha.execute("YOUR_SITE_KEY", { action: "login" }).then((token) => {
form.elements["g-recaptcha-response"].value = token; // as before
});
});
</script>Post the same two fields, secret and response, to our siteverify address. The reply has the fields your code already reads: success, score, hostname, challenge_ts and error-codes.
// Your server: only the address and the secret change. Same request, same reply fields.
// Before
$url = 'https://www.google.com/recaptcha/api/siteverify'; // or https://api.hcaptcha.com/siteverify
$secret = getenv('RECAPTCHA_SECRET');
// After
$url = 'https://captcha.fitmykb.com/siteverify';
$secret = getenv('FMK_SECRET');
$reply = json_decode(file_get_contents($url, false, stream_context_create(['http' => [
'method' => 'POST', 'timeout' => 5,
'header' => 'Content-Type: application/x-www-form-urlencoded',
'content' => http_build_query(['secret' => $secret, 'response' => $_POST['g-recaptcha-response'] ?? '']),
]])), true);
// $reply['success'], $reply['score'] (0 to 1), $reply['hostname'], $reply['challenge_ts'], $reply['error-codes']Add your website in the dashboard and test on localhost or staging first: new websites stay in test mode until we approve them. Then deploy the new script and secret together, so old reCAPTCHA tokens never reach the new check.
For v2, only the script address and the site key: the g-recaptcha box works as it is. For v3, the script address and the key passed to execute.
Yes: 10,000 checks a month on one website, with a small “Protected by FitMyKB” link. Paid plans start at ₹99 (US$2.99) a month on launch offer.
Our widget leaves g-recaptcha boxes alone while Google's grecaptcha is loaded, so remove Google's script when you switch.