It appears the intent is to do everything client side through the JavaScript API. But since interaction occurs over HTTPS, I don’t see why using server side PHP wouldn’t work. It may take some inspired interpretation though.
Google did publish a PHP library for us to use with reCAPTCHA, however it’s rather old at this point, I think it’s intended for v1 (!!!). But AFAIK the general concepts are still the same, implementation details may have changed though. It could still serve as a general guide even if it’s no longer usable.
If you’ve sent a proper verification request to the API’s endpoint you should get some kind of JSON response, even if it’s just an error message. joson_decode() the response and check for a “success” value. It’ll either be true or false. Your PHP code would then output data compatible with what your client side Ajax app is expecting as a response from your server. The app can then do whatever is appropriate as a result. For example if JSON success was false, put up an alert box reading “CAPTCHA verification failure, try again.”
The simplest way to prevent spam is to use an established plugin intended for the purpose 🙂 But if you develop your own solution, it’d be a good learning experience but there will certainly be frustrations along the way. It’s the nature of software development.
Do you know any plugins that can be added to protect a custom form?
Sorry, nothing specific. There are many anti-spam plugins. Some have a particular focus such as preventing comment or CF7 spam. But I’d expect some to be able to work with any custom form. You’ll need to review the descriptions and try out a few that look promising.
Or you could use a form builder plugin that already has some kind of anti-spam feature built in. I know that CF7 does offer support for reCAPTCHA v3. It can be used for more than just contact forms.
I decided to manually check the reCaptcha. My solution sends the form data to the web server, the token is checked by reCaptcha API and then I send the form data to the URL via the web server, rather than sending back to the client to send.