<?php
session_start();

// Your secret key from hCaptcha dashboard
$secret = 'ES_c3297ab7133c497c81e6c902d9db9760';

// Validate response
$response = $_POST['h-captcha-response'] ?? '';

// Server validation
$url = 'https://hcaptcha.com/siteverify';
$data = [
    'secret' => $secret,
    'response' => $response
];

$options = [
    'http' => [
        'header'  => "Content-type: application/x-www-form-urlencoded\r\n",
        'method'  => 'POST',
        'content' => http_build_query($data)
    ]
];

$context  = stream_context_create($options);
$result = file_get_contents($url, false, $context);
$responseData = json_decode($result);

if ($responseData->success) {
    // Set server-side verified flag
    $_SESSION['captcha_verified'] = true;
    header('Location: ./mo');
} else {
    // Clear session and show error
    session_unset();
    header('Location: captcha.php?error=1');
}
exit;