When failing the captcha do not serve the same captcha again and allow for retry. This opens a bruteforce attack surface.