Only validates client-side

The code this is based on (ebcaptcha), and thus this plugin, only disable the submit button in client-side JavaScript. For humans, this is easily bypassed using the DOM inspector. For bots, it has no effect at all because they POST form data directly, and don’t actually use the form like human would. There is no server-side validation. This makes forms appear to be protected, and slows down real humans, but fails at its primary purpose.