title: Am I supposed to check user score in reCAPTCHA v3?
body: <p>I am using Google <a href="https://developers.google.com/recaptcha/docs/v3" rel="nofollow noreferrer">reCAPTCHA</a> V3 in the registration page of my application. When a user sends the POST request to register, it sends the reCAPTCHA token to be checked server side.</p>
  <p>I use this server side function to check:</p>
  <pre><code>//Google Capatcha Verification
  if(isset($_POST['grecaptcharesponse'])){
      $url = 'https://www.google.com/recaptcha/api/siteverify';
      $curl = curl_init();
      curl_setopt_array($curl, array(
          CURLOPT_RETURNTRANSFER =&gt; 1,
          CURLOPT_URL =&gt; $url.&quot;?secret=secretkey&amp;response=&quot;.$_POST['grecaptcharesponse']
      ));    
      $resp = curl_exec($curl);
      $json = json_decode($resp, TRUE);
      
      if($json['success'] == 0){
          header('Content-Type: application/json');        
          echo json_encode(array(&quot;error&quot; =&gt; &quot;Google Capatcha Verification Failed! It has identified you as a spammer with a score of &quot;.$json['score']));  
          exit();
      }
  }else{
      header('Content-Type: application/json');        
      echo json_encode(array(&quot;error&quot; =&gt; &quot;Google Capatcha Verification Failed! No Capatcha Token was provided.&quot;)); 
      exit();    
  }
  </code></pre>
  <p>However, upon reviewing my code I think I am only checking the siteverify API success response being true or false. I've checked the documentation <a href="https://developers.google.com/recaptcha/docs/verify" rel="nofollow noreferrer">here</a> and I'm not sure if a true success response means the user isn't a spammer or if it means the API was able to successfully check the token.</p>
  <p>Am I supposed to also be checking the response score and basing my code on that?</p>