diff --git a/README.md b/README.md
index ee5c9a0..3c1af69 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,10 @@ Set secure MariaDB passwords in `.env`. Then, set at least these values in
     "db_data_directory": "/var/lib/mysqlext/",
     "redis_host": "valkey",
     "redis_port": 6379,
+    "captcha": {
+        "provider": "hcaptcha",
+        "secret": "replace with your hCaptcha secret"
+    },
     "external_plugins": ["client-config"]
 }
 ```
@@ -53,6 +57,9 @@ Set `domain` to the public host name of the backend. Do not include a protocol o
 path.
 Set `prefix` to `/{abbr}` when you use the official frontend. The
 `client-config` plugin uses this relation to create frontend API URLs.
+Create an hCaptcha site for the public frontend domain. Set its secret in the
+`captcha.secret` value. Set the related public site key as
+`VITE_HCAPTCHA_SITEKEY` in the frontend deployment.
 
 ## Start the deployment