TrustComponent
JavaScript
TrustCaptcha · Bot protection

JavaScript CAPTCHA Integration

Add a JavaScript CAPTCHA to any website in minutes with a simple form widget. It protects sign-ups, password resets, lead forms and checkouts from automated abuse, without puzzles. EU-hosted, GDPR-compliant and built with accessibility in mind.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or pick an existing one. If you want to try TrustCaptcha first, every plan comes with a 14-day free trial.

The CAPTCHA overview page shows your site key and license key, and you create your API key there. Add your website’s domains to the authorized domains in the CAPTCHA security rules so they can use your CAPTCHA.

Start of the CAPTCHA creation form.
CAPTCHA security rules of a demo CAPTCHA.

2. Integrate the CAPTCHA widget into your frontend

The following steps show roughly how to add the TrustCaptcha widget to a JavaScript frontend. For the full instructions, read the CAPTCHA integration guide for JavaScript in our documentation.

Read the documentation

First, install our TrustCaptcha JavaScript package:

Install
HTML
ECMAScript Modules (esm)
<script type="module" src="https://cdn.trustcomponent.com/trustcaptcha/3.0.x/trustcaptcha.esm.min.js"></script>

CommenJS (cjs)
<script src="https://cdn.trustcomponent.com/trustcaptcha/3.0.x/trustcaptcha.cjs.min.js"></script>

Universal Module Definition (umd)
<script src="https://cdn.trustcomponent.com/trustcaptcha/3.0.x/trustcaptcha.umd.min.js"></script>

Then add the CAPTCHA widget, the trustcaptcha-component HTML tag, to any HTML form:

example.html
HTML
<form>
  <!-- your input fields -->
  <trustcaptcha-component
    sitekey="<your_site_key>"
  ></trustcaptcha-component>
  <!-- further input fields / submit button -->
</form>

<script>
  const trustcaptchaComponent = document.getElementsByTagName('trustcaptcha-component')[0];
  trustcaptchaComponent.addEventListener('captchaSolved', (event) => {
    console.log('Verification token:', event.detail); <!-- handle success -->
  });
  trustcaptchaComponent.addEventListener('captchaFailed', (event) => {
    console.error(event.detail); <!-- handle error -->
  });
</script>

The CAPTCHA widget will now be displayed on your JavaScript website:

CAPTCHA start

Need detailed information about the JavaScript CAPTCHA integration?
Our JavaScript CAPTCHA integration guide has the detailed instructions, and our CAPTCHA samples repository on GitHub has a complete integration example.

Other frontend technology instead of JavaScript?
If you build with something other than JavaScript, or run several websites and apps, pick a different framework or platform here. If we have no pre-built integration for your frontend technology yet, your developers can integrate the CAPTCHA themselves using our documentation or ask our support team for a pre-built integration.

Angular
Contact Form 7
Craft CMS
JavaScript
Joomla
JTL-Shop
Keycloak
Magento 2
React
Shopware 6
Svelte
TYPO3
Vue
Webflow
WordPress

3. Validate the CAPTCHA result in your backend

When the CAPTCHA is complete, send the verification token to your backend. There, fetch the verification result from our servers and check it. How you proceed depends on the bot risk. You can find details on backend integration and result validation in our documentation.

Pre-built backend integrations
Our pre-built integrations add the CAPTCHA validation to your backend service. If there is none for your backend technology yet, your developers can integrate the validation themselves using our documentation or ask our support team for a pre-built integration.

.NET
Go
Groovy
Java
Kotlin
Node.js
PHP
Python
Ruby
Rust
Scala

4. Test your integration

TrustCaptcha is now active. Send a test request and check that it goes through.

CAPTCHA done

FAQs

What do I need for a JavaScript CAPTCHA on a plain website?
You add the widget script to your page, place the CAPTCHA element inside your form, and configure your site key. Then your backend must verify the token with our API before you accept the submission.
Does it work only with JavaScript, or also with other frameworks and CMS platforms?
The JavaScript integration works on any website that can run JavaScript. If you use a platform like WordPress, TYPO3, Magento, Keycloak, or a framework like Angular/React/Vue, you can also use a ready-made plugin or wrapper instead.
Why does the CAPTCHA have to be placed inside a <form>?
Because the widget is designed to work with a form: it automatically creates a hidden token field and connects the verification flow to that form. If it is not inside a form, it cannot work correctly.
How do I get the verification token and send it to my server?
The widget automatically adds a hidden input field (by default named "tc-verification-token") to your form. If you submit the form normally, the token is sent automatically; if you submit in a custom way (AJAX), you can read the hidden field or listen to the "captchaSolved" event.
Do I still need server-side validation, or is the frontend widget enough?
You should always validate on the server. The frontend widget only creates a token; your backend must verify that token with our API to make a safe decision.
Can we self-host the JavaScript file instead of loading it from your CDN?
Yes. You can host the JavaScript file on your own infrastructure, which can reduce external dependencies. If you self-host, you are responsible for updating the file when you want bug fixes and improvements.
How do we set up authorized websites (domains) for production and development?
Add the domain or subdomain you want to protect (for example "example.com" or "app.example.com"). For local testing you can add "localhost" or an IP address. Do not include protocol, ports, paths, or query parameters; wildcard domains are not enabled by default and can be activated by support if needed.
Can I use multiple CAPTCHAs on the same page?
Yes, that is possible. The recommended setup is one CAPTCHA per form; if you ever place more than one CAPTCHA inside the same form, you should use different token field names to avoid conflicts.
Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-compliant, EU-hosted.

CAPTCHA start
CAPTCHA done
No puzzles for visitors
The check runs in the background while visitors type, so more people finish your forms instead of giving up.
GDPR-compliant
Hosted in the EU, no cookies, encrypted transmission and automatic data deletion. Every customer gets a Data Processing Agreement.
Multi-layer security
Adaptive proof-of-work and risk scoring stop abuse early, even when attack traffic spikes.
Full control
Set the sensitivity, keep allow and block lists and use geoblocking. You decide how strict the check is.

Protect your JavaScript application with TrustCaptcha in just a few steps!

  • EU-hosted & GDPR-compliant
  • No puzzles
  • Try free for 14 days