Configure hCaptcha for PagibleAI

hCaptcha blocks automated contact-form submissions. PagibleAI shows and validates the challenge outside Laravel's local environment when both keys are set.

Open the hCaptcha plans, choose an account for your traffic and support needs, and verify the email address. For a production site, use an organization-owned account rather than a personal login.

1. Open the hCaptcha site settings.
2. Enter a name for the PagibleAI site.
3. Add every production and staging hostname that will show the form.
4. Save the site with the difficulty and security settings you need.

Enter hostnames without paths. Keep test and production configurations separate when they have different access rules.

Copy the public sitekey from Sites and the private siteverify secret from account settings. The sitekey appears in page markup; the secret must stay on the server. Store the secret in your deployment secret manager and rotate it if it leaks.

Add both values to the application environment. The PagibleAI theme installer connects them to Laravel's services.hcaptcha configuration:

Run the command below after changing either value. Then restart Octane, queue workers and other long-running PHP processes.

Test on staging or production; the default contact form skips hCaptcha when Laravel runs in the local environment.

1. Open the form and check that the challenge loads.
2. Submit without a valid challenge; validation should reject the request.
3. Complete the challenge and send a harmless test message.
4. Check that the message follows the site's normal delivery path.