The trouble with CAPTCHAs
Classic CAPTCHAs ask for something software is supposed to find hard: reading warped letters, spotting traffic lights in photos, understanding a noisy audio clip. Many people find exactly these tasks hard too. The W3C note Inaccessibility of CAPTCHA explains the problem in detail: every variant excludes some group of users, while bots solve many of them anyway.
What WCAG requires
- 1.1.1 Non-text Content: CAPTCHAs are a named exception, but only partly. A text alternative must describe the purpose, and an alternative form using a different sense must be offered, for example hearing instead of seeing.
- 3.3.8 Accessible Authentication (Minimum): logging in must not depend on a cognitive function test, such as remembering, transcribing or solving a puzzle, unless there is an alternative, a mechanism to help, or the test is only about recognising objects or content the user provided.
- 2.2.1 Timing Adjustable: if the task has a time limit, people must be able to extend or turn it off.
So even a permitted CAPTCHA remains a hurdle. The best one is the one nobody has to solve.
Alternatives that ask nothing of people
| Method | How it works | Watch out for |
|---|---|---|
| Honeypot field | A hidden field only bots fill in | Hide it with CSS and keep it away from keyboard and screen readers with tabindex="-1" and aria-hidden |
| Timing check | Reject forms submitted within a fraction of a second | Keep the minimum short; autofill is fast |
| Server-side rate limiting | Slow down floods of requests from one source | Show a clear error message, never fail silently |
| Invisible risk check | Runs in the background, usually without a task | If a task does appear, offer an accessible way out, such as e-mail |
| E-mail confirmation | A link in an e-mail confirms the request | Keep the link valid long enough |
| Passkeys and one-time links | Sign-in without passwords or puzzles | A good fit for 3.3.8 Accessible Authentication (Minimum) |
Hiding a honeypot properly
A honeypot is invisible to people only if keyboards and screen readers cannot reach it either. Otherwise someone tabs into it, fills it in and gets rejected as a bot.
<!-- only made transparent -->
<input type="text" name="website"
class="invisible"><div class="hp" aria-hidden="true">
<label for="hp-url">Leave this empty</label>
<input id="hp-url" name="website"
tabindex="-1" autocomplete="off">
</div>The hp class moves the block off screen with CSS. tabindex="-1" keeps keyboards out, aria-hidden keeps screen readers out.
Always offer a way out
No method is perfect, so always provide a second route that needs no test: an e-mail address or phone number people can use instead. Mention it where the check might fail and in your accessibility statement.
We do this ourselves: the form for our free check uses an invisible spam check. If a challenge appears that someone cannot complete, we start the check for them by e-mail. It is described in our own statement.
Checklist
0 of 6 done
Your ticks stay in this browser tab only and are not stored anywhere.
Related WCAG criteria
- 1.1.1 Non-text Content
- 3.3.8 Accessible Authentication (Minimum)
- 2.2.1 Timing Adjustable
- 4.1.2 Name, Role, Value
Tools and patterns for this
- Forms that everyone can completeForms are where people buy, book or give up. This guide shows how labels, required fields and error messages need to work for keyboard, screen reader and magnifier users.
- Error messages that help instead of confuseErrors as text, linked, with a fix and an error summary.
- Keyboard testSee and practise focus
- The accessibility statement: complete, honest and easy to findService providers and public sector bodies have to say how accessible their offer is. Here is what each set of rules requires and how to write a statement that actually helps people.
Frequently asked questions
Is an audio CAPTCHA a sufficient alternative?
It covers a second sense, as 1.1.1 asks. People who neither see nor hear well, or who have cognitive disabilities, are still excluded. A method without a task is better.
Does an invisible check fall under WCAG?
As long as nobody has to do anything, it creates no barrier. If a task appears in doubtful cases, the requirements apply to that task and a way out becomes essential.
Does a honeypot really stop spam?
It stops many simple bots but not all. Combined with timing checks and rate limits it becomes much more effective.
Sources
How does your website do?
The free check tests your home page in two minutes. The audit decides all 55 criteria, by a person.