CAPTCHA Puzzles Some Customers Cannot Solve

The test at the bottom of the form

A wave of spam hits the contact form, so someone adds a test: wavy, distorted letters to type, a sum to solve, or a grid of photographs to click through.

The spam stops. So do some real customers, and nobody notices that part.

People who cannot pass the test do not write in to complain. They give up after a second or third try and phone someone else, or nobody at all.

The owner sees fewer messages and assumes the spam problem is solved.

Who gets stopped

• People with low vision, who cannot read distorted letters.
• Screen reader users, when the audio version is garbled or missing.
• People with dyslexia, for whom jumbled characters are harder still.
• Older customers squinting at a small phone screen.
• Visitors with strict privacy settings, who are shown harder picture tests.

The last surprises most owners. Google's I'm not a robot checkbox decides whether to show pictures based on what it can tell about the browser, so someone who blocks cookies can face round after round of them.

Hard by design

These tests work by being easy for people and hard for software. As software got better at reading distorted text, the text got more distorted, and harder for people too.

The audio versions offered to blind visitors are often distorted speech over background noise, which many sighted people cannot make out either.

A sum to solve avoids distorted text but brings its own barrier for people who struggle with numbers, and a sum shown as an image is invisible to a screen reader.

The burden falls hardest on the people with the least margin: poor eyesight, a disability, an older phone, a slow connection.

What the standard says

WCAG 2.0, the standard that website accessibility is usually measured against, accepts a CAPTCHA only with a text description of its purpose and alternative versions that use different senses, such as sight and hearing.

The W3C, which publishes the standard, has long acknowledged that even two versions leave some people out, such as people who are both deaf and blind.

The better route is to avoid needing a test the visitor has to pass at all.

Spam protection visitors never see

A hidden field that people never see, but automated scripts fill in, catches a great deal of spam: messages with that field completed are discarded.

Give the field a label such as leave this empty, so a screen reader user who meets it knows what to do.

A time check catches more. A form submitted within a couple of seconds of the page loading was almost certainly not filled in by a person.

A spam filtering service, of the kind most WordPress sites can use, checks each message against patterns seen across many sites and moves doubtful ones to a separate folder.

Together these stop most automated spam without asking the visitor to do anything. Some still gets through, and a quick look at the doubtful folder each morning deals with it.

A worked example

A piano tuner who works alone covers a group of suburbs, mostly tuning pianos in people's living rooms. Many clients are older and have owned the same piano for decades.

Halfway through a tuning he lets the phone ring, so the booking form on his website matters.

After a month of spam through it, he added a distorted-letter test. The spam stopped, and the online bookings thinned out too.

At appointments he began hearing the same thing: I tried your website, but it would not send.

The letters were small and faint, and the audio version was hard to follow. Worse, a failed attempt cleared every field, so clients typed everything again, failed again and gave up.

He removed the test and added a hidden field, a time check and a filter that sends doubtful messages to a separate folder he checks each evening.

The phone number now sits above the form in large type, and a failed submission keeps what the client typed. A little spam still arrives, and he deletes it while reading the evening's mail.

Count both kinds of message

Before changing anything, count for two weeks how many real enquiries and how many spam messages the form delivers. Then count again after the change.

A test that stops the spam and some of the customers looks like a success in the inbox, because the inbox only shows what got through.

Phone calls that mention the website belong in the count too. They are often the first sign that the form has stopped working for someone.

If you keep a test

Some forms face heavier, targeted abuse. If a test stays, use the checkbox version, which most visitors pass with a single click, and keep its audio option available.

Make sure a failed attempt never clears what the visitor typed, and keep your phone number and email address right beside the form.

And never put a test on a form that is the only way to reach you.

Testing the form yourself

Submit your own form on a phone, then again in a private browsing window, where the checkbox test knows nothing about you.

Try it with the phone's text enlarged, with only a keyboard on a computer, and with the screen reader built into the phone itself, VoiceOver on iPhones and TalkBack on Android phones.

Count the attempts each one takes. If it takes you three tries with good eyesight and a new phone, it is taking your customers more.

The counter-case

Some forms do need a stronger barrier: account sign-ups, free sample requests and anything else that attracts automated abuse in volume.

There, a checkbox test with an audio option and a phone number beside it is a reasonable compromise.

An ordinary contact or booking form rarely needs one. Start with protection the visitor never sees, and add a test only if that genuinely fails.

Before the next spam wave

1. Submit your own form on a phone.
2. Try again in a private browsing window.
3. Remove distorted-letter tests from contact forms.
4. Add a hidden field and a time check.
5. Filter doubtful messages into a folder.
6. Show the phone number beside every form.
7. Keep typed details when a submission fails.

Step two is the test most owners never run. A form that passes easily on the owner's phone, signed in to everything, can be much harder for a visitor about whom nothing is known.

The same principle, a way in for someone who cannot use one sense, runs through video that plays with the sound off.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.