It's a risk for the Faucet in a Box script.
I can use the form of the faucet and shows on a empty site without advertising. The "form action" is located to the faucet site.
Captchas will block that. At least ReCaptcha, SolveMedia and Are you a Human. However we'll think about that on next release, thanks

.