diff --git a/mollom.js b/mollom.js
index 8898536..6cd918b 100644
--- a/mollom.js
+++ b/mollom.js
@@ -43,9 +43,12 @@ function getMollomCaptcha() {
     path += '/' + mollomContentId;
   }
 
-  // Retrieve a CAPTCHA:
-  $.getJSON(Drupal.settings.basePath + path,
-    function (data) {
+  // Retrieve a new CAPTCHA.
+  $.ajax({
+    url: Drupal.settings.basePath + path,
+    type: 'POST',
+    dataType: 'json',
+    success: function (data) {
       if (!(data && data.content)) {
         return;
       }
@@ -58,7 +61,7 @@ function getMollomCaptcha() {
       // Focus on the CAPTCHA input.
       $('input[name="mollom[captcha]"]', context).focus();
     }
-  );
+  });
   return false;
 }
 
diff --git a/mollom.pages.inc b/mollom.pages.inc
index 031dc23..4933673 100644
--- a/mollom.pages.inc
+++ b/mollom.pages.inc
@@ -23,6 +23,17 @@
  * @todo Add error handling.
  */
 function mollom_captcha_js($type, $form_build_id, $contentId = NULL) {
+  // Deny GET requests to make automated security audit tools not complain
+  // about a JSON Hijacking possibility.
+  // @see http://capec.mitre.org/data/definitions/111.html
+  // @see http://haacked.com/archive/2009/06/24/json-hijacking.aspx
+  if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    header($_SERVER['SERVER_PROTOCOL'] . ' 405 Method Not Allowed');
+    // A HTTP 405 response MUST specify allowed methods.
+    header('Allow: POST');
+    drupal_exit();
+  }
+
   // Load $form_state from cache or create a dummy state.
   $cid = 'form_state_' . $form_build_id;
   if ($cache = cache_get($cid, 'cache_form')) {