A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge shown on a website to decide whether a visitor is a human or an automated program. Classic forms ask the user to read distorted text or pick images, while newer systems score behavior in the background.
Why it matters
Sign-up, login, comment and checkout forms are common targets for bots that create fake accounts, submit spam or guess passwords. A CAPTCHA adds friction for automation without needing a person to review every submission. The trade-off is that challenges frustrate real users and can create accessibility barriers for people who are blind or have motor impairments.
Example
A site adds an invisible risk-scoring CAPTCHA to its sign-up form. Most visitors never see a puzzle. Traffic scored as suspicious gets an interactive challenge, and the server rejects any form submission that arrives without a valid verification token.
Common mistakes
- Checking the CAPTCHA only in the browser. The token must be verified on the server, or a bot can skip it.
- Offering no accessible alternative such as an audio option.
- Assuming it stops all bots. Solving services and modern AI can pass many puzzles, so combine it with rate limiting.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.