diff --git a/Pipfile b/Pipfile
index e5fe1ab..83a6845 100644
--- a/Pipfile
+++ b/Pipfile
@@ -6,6 +6,8 @@ name = "pypi"
 [packages]
 django = "*"
 pillow = "*"
+django-hcaptcha = "*"
+django-environ = "*"
 
 [dev-packages]
 mypy = "*"
diff --git a/Pipfile.lock b/Pipfile.lock
index 3b98275..fdd04c0 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "720e8538e0b5a6418b2f8e2973ef59da19390569ba586790a194f490bdabd90b"
+            "sha256": "a456453ef1b5e85ccb7ba32477a0eb8cbba7d015376c3133b2576e03259d862c"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -32,6 +32,22 @@
             "index": "pypi",
             "version": "==4.0.4"
         },
+        "django-environ": {
+            "hashes": [
+                "sha256:42593bee519a527602a467c7b682aee1a051c2597f98c45f4f4f44169ecdb6e5",
+                "sha256:6f0bc902b43891656b20486938cba0861dc62892784a44919170719572a534cb"
+            ],
+            "index": "pypi",
+            "version": "==0.8.1"
+        },
+        "django-hcaptcha": {
+            "hashes": [
+                "sha256:18804fb38a01827b6c65d111bac31265c1b96fcf52d7a54c3e2d2cb1c62ddcde",
+                "sha256:b2519eaf0cc97865ac72f825301122c5cf61e1e4852d6895994160222acb6c1a"
+            ],
+            "index": "pypi",
+            "version": "==0.2.0"
+        },
         "pillow": {
             "hashes": [
                 "sha256:01ce45deec9df310cbbee11104bae1a2a43308dd9c317f99235b6d3080ddd66e",
diff --git a/board/forms.py b/board/forms.py
index 54e94bc..14b9d73 100644
--- a/board/forms.py
+++ b/board/forms.py
@@ -1,5 +1,7 @@
+from django.conf import settings
 from django.forms import ModelForm
 from board.models import Post
+from hcaptcha.fields import hCaptchaField
 
 
 class PostForm(ModelForm):
@@ -9,6 +11,8 @@ class PostForm(ModelForm):
     This requires the board and the IP address to be specified.
     """
 
+    hcaptcha = hCaptchaField() if settings.USE_HCAPTCHA else None
+
     class Meta:
         model = Post
         fields = ["subject", "name", "text", "image"]
@@ -27,6 +31,8 @@ class ReplyForm(PostForm):
     specified.
     """
 
+    hcaptcha = hCaptchaField() if settings.USE_HCAPTCHA else None
+
     class Meta:
         model = Post
         fields = ["name", "text", "bump", "image"]
diff --git a/threadchat/settings.py b/threadchat/settings.py
index a9918ed..8ce6033 100644
--- a/threadchat/settings.py
+++ b/threadchat/settings.py
@@ -12,16 +12,19 @@ https://docs.djangoproject.com/en/4.0/ref/settings/
 
 from pathlib import Path
 from typing import Sequence
+import environ
+
+env = environ.Env()
+environ.Env.read_env()
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
-
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/4.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = "django-insecure-kxgmmxo@b=75fh!pvsq$w!ure!!*i)2sdr-5^l1o4q^)j)$a=9"
+SECRET_KEY = env("SECRET_KEY")
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
@@ -134,3 +137,10 @@ MEDIA_URL = "media/"
 THUMB_SIZE = (200, 200)
 
 MAX_UPLOAD_SIZE = 25 * 1024**2
+
+USE_HCAPTCHA = False
+
+if USE_HCAPTCHA:
+    INSTALLED_APPS += ["hcaptcha"]
+    HCAPTCHA_SITEKEY = env("HCAPTCHA_SITEKEY")
+    HCAPTCHA_SECRET = env("HCAPTCHA_SECRET")