A CAPTCHA is a challenge-response test that websites use to tell human visitors from automated bots, for example by asking users to read distorted text or select images.
How CAPTCHA works
The name stands for “Completely Automated Public Turing test to tell Computers and Humans Apart”; it was coined in 2003 by researchers at Carnegie Mellon University, including Luis von Ahn. Common types are:
- text CAPTCHAs – distorted letters and digits;
- image CAPTCHAs – “select all squares with traffic lights”;
- invisible or score-based checks – Google reCAPTCHA v3, hCaptcha and Cloudflare Turnstile analyse browser signals and behaviour and challenge only suspicious visitors;
- audio CAPTCHAs – an accessibility alternative.
Why CAPTCHA matters
CAPTCHAs slow down automated abuse: mass account registration, credential stuffing and brute-force logins, comment spam, ticket scalping and aggressive web scraping. They are not a strong barrier, however. Machine learning solves many classic puzzles better than humans, and commercial CAPTCHA-solving services use low-paid human workers to answer challenges for botnets for a small fee per thousand.
Attackers also abuse the familiar look of CAPTCHAs. In “ClickFix” campaigns, widely reported since 2024, fake “verify you are human” pages instruct visitors to press Win+R and paste a command copied to their clipboard – which actually installs infostealers such as Lumma.
Best practices
- Combine CAPTCHA with rate limiting, bot management and multi-factor authentication.
- Prefer low-friction, accessible solutions and challenge only risky requests.
- Remember: a real CAPTCHA never asks you to run commands, open the Run dialog or paste anything into a terminal.
