success = true does not indicate if submission was a bot

[lowedown]

Be aware that the concept of ReCaptcha V3 is completely different than previous versions. success = true only states whether this request was a valid reCAPTCHA token for your site. It doesn't say anything about the request being sent by a bot or a human. You will have to take $res['score'] into account for this. Example:

$scoreThreshold = 0.5; // 1.0 is very likely a good interaction, 0.0 is very likely a bot

if($res['success'] == true && $res['score'] > $scoreThreshold ) {

	// Perform you logic here for ex:- save you data to database
	echo '<div class="alert alert-success">
			<strong>Success!</strong> Your inquiry successfully submitted.
		  </div>';
} else {
	echo '<div class="alert alert-warning">
			  <strong>Error!</strong> You are not a human.
		  </div>';
}

You will have to find the ideal scoreThreshold for your application by looking at the admin console. The docs suggest starting at 0.5.
See recaptcha v3 docs for details.

[hudsantos]

Very good heads up @lowedown thank you very much.

Also here and here we can see how well known/popular contact-form-7 WordPress plugin also evaluates the response score using the default recommended threshold of 0.5.