CAPTCHA explained.
A CAPTCHA is a challenge that tries to tell a human apart from a bot before a form submission is accepted, ranging from image or checkbox puzzles to invisible checks that score behaviour in the background.
How a CAPTCHA works
The name is a strained acronym for Completely Automated Public Turing test to tell Computers and Humans Apart, and the idea is exactly that. The form asks the visitor to do something a person handles easily but a cheap script struggles with, then the answer is graded to decide whether the submission goes through.
Early versions showed warped text to retype. Later ones ask you to click a checkbox or pick every square with a bus in it (Google's reCAPTCHA), and the newest ones show nothing at all, scoring mouse movement and browser signals invisibly (Cloudflare's Turnstile). Each generation trades a little more of the visitor's patience for confidence that a real person is on the other end.
For a form backend, a CAPTCHA is one layer of spam protection you can put in front of the endpoint, so a submission that fails the challenge never reaches your inbox or your stored records.
What a CAPTCHA does and costs.
Blocks automated spam
A script that can POST your form in bulk usually can't pass the challenge, so most drive-by spam is stopped at the door.
Taxes real visitors
Every genuine person pays the challenge too, and a puzzle that is slow or fiddly is a real cost to your conversion rate.
Best used in layers
Pair a quiet honeypot with a CAPTCHA held in reserve, so most visitors never see a puzzle and targeted forms still get one.
Related questions
No, and reaching for one first is usually a mistake. A honeypot catches the automated bulk without asking anything of real visitors, so a good default is to run the honeypot everywhere and add a CAPTCHA only to a form that is being actively targeted.
How FormWire layers honeypot, CAPTCHA and rate limits →reCAPTCHA is Google's product, which often shows a checkbox or an image grid and ties into Google's ad and analytics profile. Turnstile is Cloudflare's free, privacy-friendlier alternative that usually resolves with no puzzle at all, scoring the visitor in the background instead.
Some can. Machine solvers and paid human solving farms defeat visible puzzles, which is one reason the newer invisible checks lean on behaviour and browser signals rather than a test you can outsource. No single check is perfect, which is why spam protection is layered.
It can. Image and audio puzzles are a known barrier for people using screen readers or with low vision, so an invisible, mostly non-interactive check is friendlier. Keeping the honeypot as the primary filter means most visitors face no challenge in the first place.
Want to see it working?
Read the docsStop form spam without punishing visitors.
Free tier forever. No credit card required.