hCaptcha

hCaptcha provides official integration-test keys for predictable automated tests. Its standard dashboard does not provide a general production client-IP allowlist for challenges.

Staging or test environments

Use the hCaptcha test key set that matches your account type. Test keys can produce passcodes without a question and must be verified with the matching test secret.

Test keys provide no anti-bot protection. Never deploy them to production. Get the current test values from hCaptcha's integration-testing documentation.

Production websites

  1. Turn off the FormTester 365 proxy for the website.
  2. Add a trusted-IP exception in the form plugin or server-side validation code for the FormTester 365 addresses.
  3. Scope the exception to the affected form and submission endpoint.
  4. If hCaptcha keeps the submit button disabled until a passcode exists, make sure the trusted test path can submit without changing the page for other visitors.
  5. Keep the normal hCaptcha siteverify request for every other source address.

Run a FormTester 365 manual test, then submit the form from a normal connection to confirm hCaptcha remains active.

Was this helpful?