Does your website need a CAPTCHA? Pros, cons and alternatives

Your contact form receives twenty junk messages a day advertising crypto schemes and SEO packages. The obvious fix seems to be a CAPTCHA. Before you add one, ask a better question: does your website need a CAPTCHA at all, or is there a cheaper way, in terms of lost enquiries, to solve the actual problem?

CAPTCHAs have a place, but they are a blunt tool. This guide helps you decide when they earn it and what else to try first.

What a CAPTCHA is meant to do

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. The idea is to present a task that is easy for people and hard for programs: reading warped text, clicking images with traffic lights, or ticking a box while background checks judge behaviour.

In practice, the line has blurred. Image and text recognition have improved enormously, and some attackers pay human-powered solving services. Meanwhile many real people, particularly on small phones or with disabilities, find the puzzles slow or impossible.

When a CAPTCHA is justified

A challenge makes most sense where automated abuse is costly and the form is not the main path to revenue. Typical cases:

• Login after repeated failures, to slow password guessing without bothering people who sign in normally.
• Account registration on platforms where fake accounts are used for spam, reviews or promotional abuse.
• Forms that trigger costs, such as sending SMS OTPs, where bots can run up gateway bills or send messages to strangers.
• Coupon, voucher or referral redemption that bots can exploit for fraud.
• Public comment or review forms that attract link spam at volume.
• Ticket or limited-stock drops where scalper bots are a real threat.

Notice the pattern: a measurable abuse problem, not a vague worry about bots.

The costs people forget

Lost conversions

Every extra step on a form gives visitors a reason to quit. A puzzle on a quote request form asks your warmest prospects to prove themselves before they can give you business. Some will give up and call a competitor instead.

Accessibility barriers

Visual puzzles exclude people who are blind or have low vision. Audio alternatives are often hard to understand, especially with accents or background noise. People with cognitive disabilities or motor impairments can struggle with timed or fiddly image grids. WCAG guidance expects alternatives for any CAPTCHA that relies on one sense, and the W3C has published notes on how problematic traditional CAPTCHAs are.

Mobile friction and slow connections

Image grids load extra resources and are awkward on small screens. On a weak mobile data connection, a challenge that fails to load can make the form unusable.

Privacy and page weight

Third-party CAPTCHA scripts load on your pages and may collect browsing signals. That can affect page speed and needs mentioning in your privacy policy.

Alternatives to try before a CAPTCHA

For many small business sites, these approaches stop most form spam without any visible challenge.

Honeypot fields

Add a field hidden from people with CSS and labelled so assistive technology users are told to leave it empty. Simple bots fill every field; if the hidden one contains data, reject the submission quietly. It costs real users nothing.

Time-based checks

Record when the form was loaded. A submission arriving within a second or two of page load is very likely automated. Be careful not to reject browser autofill users who genuinely fill quickly, so set a conservative threshold.

Server-side validation

Reject messages that fail basic sense checks: an Indian phone number field with letters, messages consisting only of links, or submissions in scripts your business never receives. Validation also improves data quality.

Rate limits

Limit how many submissions one IP address or session can make in a period. This stops floods without affecting normal visitors.

Spam filtering services

Content filters, such as Akismet on WordPress, analyse submissions after they arrive and flag spam for review instead of blocking the visitor upfront.

Invisible or risk-based checks

Services that score traffic in the background and only challenge suspicious visitors reduce friction for most users. They come with their own trade-offs around privacy and false positives.

Edge protection

A CDN or web application firewall with bot rules can filter known abusive traffic before it reaches the form at all.

A decision checklist

Work through these questions for each form on your site:

1. Is there a measurable abuse problem on this form today, not just a hypothetical one?
2. What does the abuse cost: time, money, reputation or security?
3. Have honeypot, timing, validation and rate limits been tried?
4. Is this form a direct route to revenue or enquiries, where friction hurts most?
5. Can the challenge be shown only to suspicious traffic rather than everyone?
6. Is there an accessible alternative for people who cannot complete it?
7. Does your privacy policy cover the service you would add?

If you answered yes to the first two and the lighter measures have failed, a CAPTCHA, preferably a low-friction one, is reasonable.

Measure before and after

Whatever you choose, track results. Note spam volume and genuine form submissions for two weeks before the change and two weeks after. If spam drops but genuine enquiries fall noticeably too, the cure may be worse than the disease.

Our team builds forms with layered spam protection as standard in landing page development, and existing clients can request a review via support if junk submissions are piling up.

Frequently asked questions

Do CAPTCHAs hurt conversion rates?

Any additional step can reduce completions, and visible puzzles add noticeable effort. The impact varies by audience and form, so measure genuine submissions before and after adding one.

Is a honeypot field enough to stop contact form spam?

For many small business sites it stops a large share of simple bots. More targeted spam may need rate limiting, content filtering or a risk-based check as well.

Are CAPTCHAs accessible for blind users?

Traditional visual CAPTCHAs are a significant barrier. Audio versions help some users but not all, so accessible alternatives or invisible checks are preferable.

Should I put a CAPTCHA on my login page?

Showing one on every login adds friction for all users. A common approach is to show it only after several failed attempts or when traffic looks automated.