Add reCAPTCHA to a Form Without Trusting the Browser
A reCAPTCHA widget is only the browser half of the control. This implementation verifies each short-lived, single-use token on the server, checks the expected hostname, handles failures safely, and layers reCAPTCHA with ordinary anti-abuse controls.