CAPTCHA

The name stands for "Completely Automated Public Turing test to tell Computers and Humans Apart". Early versions asked people to type distorted letters. Modern ones more often show a checkbox, ask visitors to pick images, or run invisibly in the background and only challenge visitors who look suspicious.

A CAPTCHA filters bots, not bad people. It slows down automated spam, fake sign-ups and password-guessing, but a determined attacker can pay low-cost human solving services, and the test does nothing against a real person typing abuse. It is one tool among several for protecting forms.

How it works

Most sites use a third-party service rather than building their own. The site adds the provider's script to the page. When a visitor interacts with the form, the script collects signals such as how the mouse and keyboard are used, browser characteristics and the reputation of the visitor's network, and either passes the visitor straight through or shows a challenge.

If the visitor passes, the provider issues a token that is sent with the form. The site's server then checks that token with the provider before accepting the submission. This server-side check is essential; a CAPTCHA that is only displayed on the page but never verified on the server can be bypassed by bots that post directly to the form.

Some services return a score instead of a pass or fail, leaving the site to decide what to do with low scores, such as blocking, flagging for review or asking for email confirmation. Lighter alternatives work alongside or instead: a honeypot field hidden from humans that bots fill in, a minimum time before a form can be submitted, and rate limits on how often one source can submit.

Example

A dental clinic's contact form receives dozens of spam messages a day, burying real appointment requests. The developer first adds a hidden honeypot field and a check that rejects forms submitted within two seconds of loading, which removes most of the spam with no visible change for patients.

A few persistent bots still get through, so the clinic adds an invisible CAPTCHA that only challenges suspicious visitors, verified on the server. Spam drops to a handful a week. The developer also checks that the form still works with a keyboard alone and with a screen reader, and that a visitor who fails the check sees a clear message with the clinic's phone number rather than a silent error. The clinic's privacy policy is updated to mention the CAPTCHA provider, because its script processes data about each visitor.

Why it matters for your business

Spam and fake sign-ups waste staff time, fill your inbox, can get your email domain flagged and, on login forms, open the door to password-guessing attacks. A CAPTCHA reduces that, but every visible challenge also costs some real enquiries, and difficult puzzles can block people with visual or motor impairments, which conflicts with accessibility goals and WCAG guidance. Many CAPTCHA scripts also load third-party code that may need to be mentioned in your privacy and consent arrangements. Start with invisible methods and only add a visible test where abuse continues. You can check whether yours works by submitting your own form from a phone and watching for real messages being lost.

Common mistakes

• Showing a CAPTCHA but never verifying the token on the server, so bots bypass it completely.
• Using hard visual puzzles with no accessible alternative, which locks out some genuine visitors.
• Putting a challenge on every form and every page, adding friction where there is no spam problem.
• Relying on a CAPTCHA alone to protect logins, instead of also using rate limits and two-factor authentication.

Questions people ask

Do CAPTCHAs hurt conversions?

Visible challenges can, because every extra step loses some visitors and difficult puzzles frustrate people. Invisible or score-based CAPTCHAs that only challenge suspicious traffic have far less effect. Test your own form and compare enquiry numbers before and after adding one.

Are CAPTCHAs accessible?

Many are not, especially image and distorted-text puzzles, which can block people who are blind or have low vision, motor impairments or cognitive disabilities. Prefer invisible checks, honeypots and rate limits, and if a challenge is needed, choose a provider that offers an accessible alternative.

What can I use instead of a CAPTCHA?

A hidden honeypot field, a minimum submission time, server-side rate limiting, email confirmation for sign-ups and spam filtering on submitted text all stop a large share of bots without asking visitors to do anything. Combine them, and add a CAPTCHA only if abuse continues.