Google's works with JS, though, right? It's not a service where you feed it a request and it responds how likely that request is to be spam, right?

I know JS is probably better for this, since you can do all sorts of things like measure how the user types and scrolls and whatnot.