diff --git a/mollom.js b/mollom.js
index 8898536..6cd918b 100644
--- a/mollom.js
+++ b/mollom.js
@@ -43,9 +43,12 @@ function getMollomCaptcha() {
     path += '/' + mollomContentId;
   }
 
-  // Retrieve a CAPTCHA:
-  $.getJSON(Drupal.settings.basePath + path,
-    function (data) {
+  // Retrieve a new CAPTCHA.
+  $.ajax({
+    url: Drupal.settings.basePath + path,
+    type: 'POST',
+    dataType: 'json',
+    success: function (data) {
       if (!(data && data.content)) {
         return;
       }
@@ -58,7 +61,7 @@ function getMollomCaptcha() {
       // Focus on the CAPTCHA input.
       $('input[name="mollom[captcha]"]', context).focus();
     }
-  );
+  });
   return false;
 }
 
diff --git a/mollom.pages.inc b/mollom.pages.inc
index 031dc23..4933673 100644
--- a/mollom.pages.inc
+++ b/mollom.pages.inc
@@ -23,6 +23,17 @@
  * @todo Add error handling.
  */
 function mollom_captcha_js($type, $form_build_id, $contentId = NULL) {
+  // Deny GET requests to make automated security audit tools not complain
+  // about a JSON Hijacking possibility.
+  // @see http://capec.mitre.org/data/definitions/111.html
+  // @see http://haacked.com/archive/2009/06/24/json-hijacking.aspx
+  if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    header($_SERVER['SERVER_PROTOCOL'] . ' 405 Method Not Allowed');
+    // A HTTP 405 response MUST specify allowed methods.
+    header('Allow: POST');
+    drupal_exit();
+  }
+
   // Load $form_state from cache or create a dummy state.
   $cid = 'form_state_' . $form_build_id;
   if ($cache = cache_get($cid, 'cache_form')) {
diff --git a/tests/mollom.test b/tests/mollom.test
index a3ea09c..5845284 100644
--- a/tests/mollom.test
+++ b/tests/mollom.test
@@ -3806,7 +3806,19 @@ class MollomCaptchaTestCase extends MollomWebTestCase {
     // (without having a contentId)
     $this->drupalGet('mollom-test/form');
     $form_build_id = $this->getFieldValueByName('form_build_id');
-    $out = $this->drupalGet('mollom/captcha/audio/' . $form_build_id);
+
+    // @see drupalPost(), drupalGet()
+    $path = url('mollom/captcha/audio/' . $form_build_id, array('absolute' => TRUE));
+    $out = $this->curlExec(array(
+      CURLOPT_URL => $path,
+      CURLOPT_POST => TRUE,
+    ));
+    // Ensure that any changes to variables in the other thread are picked up.
+    $this->refreshVariables();
+    $this->verbose('POST request to: ' . $path .
+                   '<hr />Ending URL: ' . $this->getUrl() .
+                   '<hr />' . $out);
+
     $this->assertResponse(200);
     $this->assertText('mollom-captcha-player.swf');
     $response = drupal_json_decode($out);