Configure hCaptcha for PagibleAI

hCaptcha blocks automated contact-form submissions. Outside Laravel's local environment, PagibleAI shows the challenge when the sitekey is set and validates it on the server when the secret is set, so always configure both keys together.

Open the hCaptcha plans, choose an account for your traffic and support needs, and verify the email address. For a production site, use an organization-owned account rather than a personal login.

1. Open the hCaptcha site settings.
2. Enter a name for the PagibleAI site.
3. Add every production and staging hostname that will show the form.
4. Save the site with the difficulty and security settings you need.

Enter hostnames without paths. Keep test and production configurations separate when they have different access rules.

Copy the public sitekey from Sites and the private siteverify secret from account settings. The sitekey appears in page markup; the secret must stay on the server. Store the secret in your deployment secret manager and rotate it if it leaks.

Add both values to the application environment. The PagibleAI theme installer connects them to Laravel's services.hcaptcha configuration:

Run the command below after changing either value. Then restart Octane, queue workers and other long-running PHP processes.

Set both values or none. With only the secret, the form doesn't show the challenge but the server still requires a valid response, so every submission fails. With only the sitekey, visitors see the challenge but the server never verifies it.

Test on staging or production; the default contact form skips hCaptcha when Laravel runs in the local environment.

1. Open the form and check that the challenge loads.
2. Submit without a valid challenge; validation should reject the request.
3. Complete the challenge and send a harmless test message.
4. Check that the message follows the site's normal delivery path.

The contact element lets editors choose the mandatory and optional form fields (name, company, telephone, e-mail, subject or own field names); name and e-mail are mandatory by default. The form fetches its CSRF token from cmsapi/csrf only when a visitor submits it, so cached pages keep working. Submissions are limited by the cms-contact rate limiter to two per minute per IP address, so send test messages at least 30 seconds apart.