Handling missing tokens (no JavaScript)

simplecaptcha requires JavaScript and WebAssembly (available in >99% of browsers). Visitors without JavaScript submit your form without the simplecaptcha-response field; /v1/siteverify then returns missing-input-response.

Recommendation: don't hard-reject — degrade. A missing token is not proof of a bot; it's a visitor you couldn't verify:

if (!token) {
  // No token: route to manual review instead of rejecting —
  // e.g. moderation queue, email double-opt-in, or rate limiting.
  await queueForReview(submission)
} else {
  const result = await captcha.verify(token)
  …
}

Suitable fallback paths, depending on the form:

• Contact forms: accept, but into a moderation queue.
• Registrations: enforce email double-opt-in.
• Checkout: server-side rate limit per session; manual order review when in doubt.