CAPTCHA

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is a challenge inserted into web interactions — sign-up forms, logins, comment boxes, checkouts — whose purpose is to verify that the visitor is a human being rather than an automated script, blocking bulk abuse at the point of entry.

How CAPTCHA works

Early CAPTCHAs relied on tasks humans solved easily but machines could not: retyping distorted letters, solving trivial arithmetic, or selecting images containing traffic lights. As machine vision improved, bots began beating these puzzles, so the industry shifted from explicit challenges to behavioural analysis:

• Checkbox CAPTCHAs (reCAPTCHA v2) — the "I'm not a robot" box evaluates cursor movement and browser signals, escalating to an image challenge only when unsure;
• Invisible, score-based systems (reCAPTCHA v3, Cloudflare Turnstile) — run silently in the background and return a risk score, letting the site decide whether to allow, challenge or block the request;
• hCaptcha — a privacy-focused alternative widely used behind DDoS-mitigation services;
• Honeypots — hidden form fields invisible to humans; anything that fills them is a bot.

Practical use cases

CAPTCHAs defend against comment and contact-form spam, fake account registration, content and price scraping, ticket-buying bots, and credential stuffing — the automated testing of leaked passwords against login pages. On authentication endpoints they form one layer of a defence-in-depth stack alongside rate limiting, lockouts after failed attempts and two-factor authentication; a CAPTCHA alone will not stop a patient attacker with a brute-force toolkit and a CAPTCHA-solving farm.

Two implementation concerns matter. Accessibility: every challenge needs an audio or alternative variant, otherwise the site excludes users with visual impairments and fails WCAG requirements. And user experience: challenges should trigger only on suspicious traffic — a CAPTCHA shown to every customer at checkout measurably increases cart abandonment, often costing more revenue than the bots it blocks.