Well the way I see it have a few options:
1: Use jQuery to .hide() and .show() the form after verification. While user friendly I’m not sure this would deter the bots since the html form will still be visible in your source when ‘hidden’
2: Use a separate form that will validate the user input (from captcha or some other service) and then upon proper entry will display the whois form. This could be used to store a cookie or session variable to mark the user as human and let them query the whois form multiple times without revalidating.
3: Add a new required form field to your existing whois form that would serve as user validation and submit it at the time of the Whois request – if it doesn’t validate don’t submit the request.
Options 2 and 3 would both require some digging around in your code to find where the shortcode is generated and add in the new form fields.