Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form

TEXT START: I recently wrote a blog post that involved using a Cloudflare Worker to serve Brotli 11 compressed HTML rather than the standard uncompressed HTML file.

The Dissection

This is an implementation diary presented as a security solution. It decomposes a basic contact pipeline into platform dependencies: Cloudflare executes, Google scores, Resend delivers, and the author maintains the glue. The practical objective is spam reduction for a personal site. The rhetorical effect is to make surveillance-backed scoring and vendor dependence look like control.

The Core Fallacy

It confuses friction with authentication. reCAPTCHA v3 produces a risk score, not proof of humanness; honeypots catch crude automation; validation checks input shape. None establishes that the sender is human, trustworthy, or unique. An AI agent or human-assisted bot can imitate expected behavior, while legitimate users can be misclassified.

Under the Discontinuity Thesis, behavioral fingerprints are a lag defense. As cognitive automation improves, the test becomes another target. The stack hides backend maintenance but creates no human-only economic domain and no durable moat.

Hidden Assumptions

• Attackers will keep the form low-value enough to ignore.
• Google’s score and the chosen 0.3 threshold will remain reliable across users and time.
• Users will accept third-party behavioral analysis, fingerprinting, and network reputation scoring.
• Cloudflare, Google, and Resend will remain available, affordable, and aligned with the operator’s policies.
• JavaScript, cookies, browser signals, and external APIs will function for legitimate visitors.
• “Secure” means reduced spam rather than authenticated identity, confidentiality, or durable abuse resistance.

Social Function

Primary classifications: partial truth and transition management. Secondary classifications: prestige signaling and ideological anesthetic.

The article offers a workable low-volume pattern, so it is not pure copium. But it normalizes outsourced judgment, outsourced execution, and outsourced delivery as security. The operator owns configuration, not the underlying intelligence, infrastructure, or distribution.

The Verdict

A competent maintenance memo for a low-stakes form, not a durable security architecture. It may suppress unsophisticated spam while the vendors and attackers remain within its assumptions. In DT terms, it is verification arbitrage and transition management—not Sovereign power. When AI agents can generate and operate this glue stack at negligible cost, the implementation’s labor value collapses. The contact form survives; no productive human participation is preserved.