What is Captcha? Definition, examples and how to use it (Gecko Dictionary)

Captcha

💡 We apply this in: secure WordPress maintenance →

What is a captcha?

A captcha is a test designed to tell humans apart from automated bots. The name is an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart." It asks the visitor to do something easy for a person but hard for a script — read distorted text, select images, or simply tick a box that analyses behaviour in the background.

You'll most often meet captchas on forms, logins and checkout pages, where they stop automated abuse before it reaches the site.

What captchas protect against

Spam: bots flooding contact and comment forms with junk submissions.
Fake registrations: mass-created accounts used for fraud or abuse.
Credential attacks: automated attempts to guess passwords at scale.
Scraping and bulk actions: scripts harvesting data or abusing functionality.

Common types

Text or image captchas: the classic distorted characters or "select all the traffic lights" grids.
Checkbox (reCAPTCHA): a single "I'm not a robot" tick backed by behavioural analysis.
Invisible / scoring: modern versions that run silently and only challenge suspicious visitors, keeping the experience frictionless.

Security vs user experience

Captchas are a trade-off: too aggressive and they frustrate real users and hurt conversion; too weak and bots get through. The current best practice favours invisible or low-friction options that protect the site without getting in the visitor's way — part of building a secure, well-maintained website. Get in touch if you need help protecting your forms.

More on this topic

The part that gets overlooked is accessibility. A test built to be hard for a machine is often hard for a person too:

Distorted text defeats screen readers, and the audio alternative that is meant to fix it is frequently unusable in a noisy room or with a hearing impairment.
Image grids assume good vision, colour perception and cultural familiarity with what is in the photo — a "crosswalk" does not look the same everywhere.
Short timers and repeated challenges punish anyone using a keyboard, a screen magnifier or an assistive device, and anyone whose connection makes the widget reload.

This matters beyond good manners: in the EU, accessibility requirements now reach a large share of private-sector websites, and a form that only some people can complete is a form that excludes customers. The practical answer is to stop treating the captcha as the first line of defence. Honeypot fields, rate limiting and server-side validation stop most automated abuse without asking the visitor to prove anything, and an invisible scoring captcha can sit behind them to challenge only the suspicious minority.

A captcha also does nothing about spam that arrives by hand. If the junk keeps coming through a solved challenge, the problem is not the bot filter.

Related: WordPress maintenance.

Updated on 9 August 2026