Bridge WAF
Types of CAPTCHA, and what each one costs real people
A CAPTCHA can take many forms: letters to read, pictures to pick, a sound to transcribe, a slider to drag, or nothing visible at all. Each type was invented because automation learned to pass the one before it, and each one shifts the cost to a different group of real people. Choosing a type is choosing whom you are prepared to inconvenience.
Quick facts
- Visible types
- Distorted text, image selection, audio, puzzles and sliders, simple logic questions
- Invisible types
- Behavioural scoring and honeypot fields
- Accessibility
- Every visual or audio test excludes some people; see W3C, Inaccessibility of CAPTCHA
- Accessible requirement
- Offer an alternative in a different mode, not only a different puzzle
- What none of them prove
- That the visitor is a person; they only make automation more expensive
What a CAPTCHA is and why bots still pass is on CAPTCHA.
The main types of CAPTCHA
| Type | What the visitor does | Who it locks out |
|---|---|---|
| Text CAPTCHA | Reads distorted letters and types them | People with low vision, dyslexia; many people on small screens |
| Image CAPTCHA | Picks every square showing an object | Blind and low-vision users; slow connections |
| Audio CAPTCHA | Listens to spoken characters and types them | Deaf and hard-of-hearing users; noisy places; non-native speakers |
| Puzzle or slider | Drags a piece into place | People with motor impairments; keyboard-only users |
| Logic question | Answers a simple question or sum | People with cognitive disabilities; non-native speakers |
| Invisible scoring | Nothing, unless the score is low | People with privacy tools, unusual setups, shared networks |
The last row is the hardest to notice: when invisible scoring fails, the visitor gets a harder puzzle or a refusal with no explanation.
Audio CAPTCHA
Audio CAPTCHAs exist so that people who cannot see an image test can still pass. They play spoken letters or numbers over background noise. The W3C notes that they are often hard to understand even for people with good hearing, and that they replace one excluded group with another rather than removing the barrier.
Speech recognition has improved to the point where many audio tests are easier for programs than for people. Offering audio as the only alternative to images is no longer enough.
Invisible CAPTCHA and behavioural scoring
An invisible CAPTCHA asks nothing at first. It watches how the page is used, how the browser behaves and where the request comes from, and gives the visit a score. Only low scores see a challenge.
Most people never notice it, which is its advantage. Its cost falls on people whose setups look unusual and who cannot see or contest the score; why they keep failing is on “Are you a robot?”.
Honeypot CAPTCHA
A honeypot is a form field hidden from people but present in the page's code. People leave it empty; simple bots that fill every field do not, and their submissions are discarded.
It costs real users nothing when built correctly, which means hidden from screen readers as well as from sight, and not filled in by the browser's autofill. It stops only bots that fill fields blindly, so it is a first filter rather than a complete answer.
Choosing a CAPTCHA type
- Start with what asks nothing. Honeypot fields, rate limits on the form, and checks on what was submitted.
- Add a challenge only where abuse is real, and only for visits that already look suspicious.
- Offer at least two modes, for example visual and a non-puzzle route such as an email link.
- Measure abandonment. Compare how many people leave at the check with how much abuse it stops.
Responses to automation that ask nothing of people are on blocking bots.
Questions
What are the types of CAPTCHA?
Distorted text, image selection, audio, puzzles and sliders, logic questions, invisible behavioural scoring, and honeypot fields.
What is an audio CAPTCHA?
An audio CAPTCHA plays spoken letters or numbers over background noise for the visitor to type, as an alternative for people who cannot use image tests.
What is an invisible CAPTCHA?
An invisible CAPTCHA scores a visit from behaviour and browser signals without asking anything, and shows a challenge only when the score is low.
What is a honeypot CAPTCHA?
A honeypot is a form field hidden from people; bots that fill every field reveal themselves by filling it, and their submissions are discarded.