diff --git a/src/templates/save.eta b/src/templates/save.eta
index 0f0c237..124f24e 100644
--- a/src/templates/save.eta
+++ b/src/templates/save.eta
@@ -35,7 +35,7 @@
   </h3>
 </div>
 
-<script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
 <script>
   const url = "<%= it.url %>"
   const websocket = "<%= it.websocket %>"
@@ -63,7 +63,7 @@
         return
       } else if (msg.data.startsWith('CAPTCHA -')) {
         captcha.style.display = 'block'
-        hcaptcha.render(captcha, {
+        turnstile.render('#captcha', {
           sitekey: sitekey,
           callback: function(token) {
             captcha.remove()
diff --git a/src/utils/common.ts b/src/utils/common.ts
index ec287a6..47ea38f 100644
--- a/src/utils/common.ts
+++ b/src/utils/common.ts
@@ -36,17 +36,16 @@ function convertRelativeToDate(relativeTime: string) {
   return currentDate;
 }
 
-async function checkCaptcha(response: string, remoteIp: string): any {
-  const confirm = await (await fetch('https://api.hcaptcha.com/siteverify', {
+async function checkCaptcha(response: string, remoteIp: string): Promise<any> {
+  const confirm = await (await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
     method: 'POST',
-    body: new URLSearchParams({
+    body: JSON.stringify({
       'response': response,
-      'secret': process.env.CAPTCHA_SECRET!,
-      'remoteip': remoteIp,
-      'sitekey': process.env.SITEKEY!
+      'secret': process.env.CAPTCHA_SECRET,
+      'remoteip': remoteIp
     }),
     headers: {
-      'content-type': 'application/x-www-form-urlencoded'
+      'content-type': 'application/json'
     }
   })).json()