We're already using Cloudflare, so we could use [Cloudflare Turnstile][turnstile]. This basically involves a Cloudflare-hosted [Javascript challenge](docs), which is then verified on the server. [turnstile]: https://www.cloudflare.com/en-gb/application-services/products/turnstile/ [docs]: https://developers.cloudflare.com/turnstile/tutorials/login-pages/