Websites should use ReCAPTCHA, but set a cookie that includes sufficient (pseudo) random numbers. Keep a copy on your server. As long as a browser provides a c

Websites should use ReCAPTCHA, but set a cookie that includes sufficient (pseudo) random numbers. Keep a copy on your server. As long as a browser provides a cookie that is present on your server, there is no need for another ReCAPTCHA. If the user misbehaves, e.g. too many wrong guesses of password(s), remove the cookie from your server. You can even email the user the cookie as a url e.g. example.com/?cookie=12345678901234567