Glossary · Accessibility term
CAPTCHA
Also called: Completely Automated Public Turing test to tell Computers and Humans Apart
A CAPTCHA is a test a site puts in front of you to prove you are a person and not a program. Distorted letters to retype, or photos to pick the traffic lights out of. WCAG does not ban them, and what it does ask for is more than most sites provide. Two things are required together, not one or the other. Text identifying and describing what the test is for, and alternative forms of it using different senses, so somebody who cannot do the visual version has a real route through. WCAG 2.2 then added a tighter rule for logins. A cognitive test is not allowed there at all unless the step also offers one of four things. Another way in, a mechanism that helps you complete the test, object recognition, or something you provided yourself.
In practice
Every kind of CAPTCHA locks somebody out, and W3C says so in its own words. Its Working Group's position is that every type will be unsolvable by users with certain disabilities. It permits them anyway, on the reasoning that banning them outright would push sites into abandoning WCAG rather than abandoning CAPTCHA. The list of who gets excluded runs a long way past blindness. People who are blind, who have low vision or dyslexia, who are deaf or hard of hearing, who have an auditory processing disorder, and who do not read English. And one more group, because the pattern expects several failed attempts as a matter of course. People living with an anxiety disorder.
The live constraint now is 3.3.8 Accessible Authentication. Recognizing objects is one of its four exceptions, so pick the buses clears that rule at Level AA and only fails the AAA version of it. Retyping distorted characters is transcription, which counts as a cognitive function test with no carve-out, so it fails inside a login unless you offer an alternative method or a mechanism that helps. Watch which mechanism answers which test. Copy and paste is the one named for anything somebody has to retype, and a password manager is the one named for remembering a password, which is why blocking paste on a sign-in form takes away a route the rule was counting on. An audio version of the same distorted characters is not the alternative either, because transcribing it is the same test again.
W3C recommends three steps past the minimum, and all three are cheap. Offer more than two modalities rather than the two the rule asks for. Give people a route to a human who can bypass the test. And do not put one in front of users who are already signed in.
Why it matters
These sit at the front door. Sign-up, login, checkout, contact. A barrier there does not degrade the experience, it ends it, and the person who hits it often cannot tell you, because the contact form is behind the same test. It is also the one accessibility problem where the honest fix is usually removing the thing. Audio alternatives have been shown to be about 90% solvable by machine, using the same speech recognition their own vendor sells. And one major vendor has taken to not serving the audio option it advertises on screen. A test that keeps disabled people out while letting programs through has stopped doing either job.
Better options, with one catch
Honeypot fields, rate limiting, proof-of-work, limited-use accounts and server-side risk scoring all keep programs out without asking a person to prove anything, and W3C welcomes the invisible ones for exactly that reason. The catch is worth knowing before you swap. Risk scoring works by profiling the visitor, so what you are trading away is some of their privacy rather than nothing at all.
Where this shows up on the site
Related terms
- TimeoutA timeout is a time limit the content sets, such as a session that expires, a booking held for ten minutes, or a form that clears itself after a while.
- Cognitive disabilityCognitive disability is a broad group of conditions affecting how people take information in, hold on to it, and act on it.
- Error identificationError identification is the Level A rule that when your form rejects something, the page names the field that failed and says in text what went wrong.
- Form labelA form label is the visible text naming a field, tied to that field in code so software can tell which words belong to which box.
Knowing the word is the easy part.
Find out where your own site stands. The free scan checks 10 pages in a real browser against all 90 supported automated rules, separates 27 best-practice checks from its WCAG findings, and names the rule behind every result.