from the official google docs, set Content-Security-Policy:
Content-Security-Policy
script-src https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ frame-src https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/