How Does CAPTCHA Really Work?

Having to prove that you’re indeed a human every time you try to access a secure webpage is annoying😡. But necessary. 

You must have filled out a gazillion Captchas to date, but do you know what they are? Or why do some websites have a tricky captcha to challenge you🤔? That’s because it tells them whether you’re a human or a bot.

Bots🤖 make up a whopping 40% of online traffic. A huge percentage of website visitors could be bots. And these are no ordinary bots. They’re designed to browse your website, look for ways to access your database, and use the data maliciously. 

These bots can then be used for digital ad fraud, personal data harvesting, and transaction fraud, among other things. Naturally, any website would want to protect themselves from these harmful elements.

That’s when captchas comes into the picture. Yes, they’re frustrating, but they’re ultimately protecting your data. If you want to know everything about captcha and how it works, stay with me till the end of this post. I am revealing all the secrets about these tests. 

What is a CAPTCHA?

Let’s first address the elephant🐘 in the room. Captcha is an acronym for “Completely Automated Public Turing Test to Tell Computers and Humans Apart.”

As the name suggests, it’s a response test that helps websites distinguish human visitors from bots. Consider them security checks designed to prevent hackers and spammers from inserting malicious codes by using the forms on the web pages. 

The test tells them whether an actual human is trying to visit their website or a bot. Humans are welcomed with open arms. Bots? Not so much. If you pass the test, you are directed to the webpage you’re trying to visit. If you fail, it doesn’t matter how many brain🧠 cells you have; you’re a bot in the eyes👀 of the website. So, these tests need to be taken seriously. 

Captcha first came into the picture around the late 90s. While the early Captchas looked much like distorted letters and numbers, they have evolved tremendously and become more challenging. 

Also read: Google Unsafe Website Warning Messages and Their Meaning.

How do CAPTCHAs Work?

A captcha is usually triggered when you try to access specific web pages. They ask you to do a simple task, based on which they can assess whether it’s a human or a bot trying to get in. Bots won’t be able to answer the questions, but humans can.

The most used captcha is the one where you’re given a series of letters or numbers in a misshapen or distorted manner, and you have to make sense of them and enter the correct letters or numbers.

A bot won’t be able to figure out such a captcha, but as humans, it’s a piece of cake for us. Captcha is very simple if you’re a human. Another simple Captcha is when the webpage asks you to tick off the “I’m not a robot” box, and you’re in! 

However, the bots are becoming smarter, so the Captchas also had to level up their game. You’d find various types of captchas now, from the simple tick mark ones to the complex image-based ones.

There are also audio captchas, where a recording of random letters and numbers is played, and you have to input the correct characters after listening to the note. These are designed for visually impaired users. The challenge is that the audio has some background noise to it. Only humans can make out the letters and words amid so much noise.

Bots tend to fail the captcha test because of the color gradients and background noise. Moreover, the Captcha codes cannot be copied. There’s a slim chance that any bot would get through.

The most popular test is Google’s ReCaptcha. Remember how sometimes, Google asks you to select pictures with a particular object? That’s reCaptcha! If you pass the test, you’re considered human by Google or the website, and you get access to the website’s content as a human would.

If you fail, you’d be considered a bot, and the access will be denied. While Captcha has proven to be a success for a long time, many bot developers have outpaced it. The captcha developers would now have to up their game, too.

What are CAPTCHAs used for?

The fundamental use of a Captcha is to differentiate between humans and bots. Websites hate bots. But why so? Here is why websites don’t want bots to visit their website, and thus, put security checks like captchas in place to deter them. 

#1. Bots Can Create Fake Accounts 

By creating fake accounts and using website resources, bots deployed by hackers can increase traffic (fake traffic), burden the servers, and sometimes deny website services to real users.

This can cost the website owners resources, money, and even reputation. Moreover, they can also launch a phishing campaign and scam other users.

#2. Spamming Contact Forms 

A lot of service websites offer contact forms. If bots get free access to the websites, they can spam the forms with fake information, wasting the service providers’ time. It becomes difficult for them to differentiate bot forms from the real ones.

In addition to this, bots can also spam websites with fake comments. Some of them can include dangerous links. Users who click on the malicious links risk being scammed, with their personal information stolen.

Also read: How Much is Your Personal Information Worth on the Dark Web?

#3. Tamper With Online Polls 

One of the prime ways bots attack websites is by inputting fake product ratings on sites like Amazon. This makes certain products look better or worse, based on some bot’s input rather than an authentic review.

Imagine losing out on a shiny pair of quality boots just because some bots rated it 2⭐⭐ out of 5. Or spending $60 on a pair of hiking shoes with 5 ratings, only to find it of low quality? You’re out of money and not one pair of good shoes!

Bots can be a nightmare for eCommerce sites, and the best way to prevent them from visiting the sites is to create Captchas. 

Types of CAPTCHAs 

There are several types of Captchas out there. The many variations exist because the smarter the Captcha gets, the smarter the bots get😅. So, Captcha developers must constantly wrack their brains to beat the bots at their game.

Here are some common types of Captchas used by websites to keep their content safe:

#1. Math Problems 

In this Captcha, you get an elementary-level math problem to solve. They’re as simple as a sum of 1 and 3 or 5 and 10.

Since such a question requires human logic, bots will likely fail the test. Such captchas are widely used in HTML and WordPress websites.

#2. Word Problems 

Another common type of Captcha is word problems. You get a series of random letters and words, and you have to type it out. You also get the word problems in audio form, which visually challenged users can use to gain access.

However, if you trust your ears more than your eyes, anyone can use the audio Captcha to gain access. Since such problems test your logical understanding, bots are again likely to fail. Humans tend to pass, if not on the first try, definitely on the 5th. 

#3. Confident Captcha 

This Captcha asks you to match the text with some images it provides. It can ask you to find traffic lights from an image divided into several parts as a grid. You have to click on the parts of the image that have traffic lights in them.

If you’ve encountered this Captcha, you’d know it’s not easy to pass this one. I always struggle with deciding whether that one tiny metal part of the traffic light that’s protruding at the edge of one image should be selected or not. And I think most humans have faced this challenge.

Good luck, bots. You’ve got a challenge here. 

#4. Honeypot Captcha 

Now comes the king of all Captchas. Honeypot Captchas is the most challenging test to date for bots. It’s like a treasure hunt, but humans find it easy to solve it. In this one, there are hidden fields within a form to trap the bots.

Bots may have a history of being able to crack this Captcha, but naturally, the developers have advanced their game and come up with challenges that bots can’t solve.

#5. Image-based Captcha

Image-based Captchas are pretty common. Several images are displayed, and you get prompts like “Select the images of mountains and hills.” The pictures you get are very random, with photos of streets, gardens, alleys, mountains, and hills.

Since it’s easy to differentiate between mountains and streets, these Captchas are easy for humans to solve, but not for bots. The pictures might be related in some Captchas and unrelated in some. If the Captcha includes dissimilar images, you might be given the option to “Skip.”

#6. Text-based Captcha

This is one of the oldest forms of Captcha. In this, you get a sequence of letters and words with a highly distorted environment.

They could either be blurred, positioned awkwardly, have scratches or dots on them, or have dots behind them. Essentially, anything to make the letters hard to decipher for bots. For humans, it can be easy. Although, some Captchas can be a head-scratcher.

Disadvantages of Using a Captcha

While Captcha does an important job of protecting the data of a website, it can come with some disadvantages. Here are some you need to know about. 

#1. Bad User-experience

I can’t think of one person who likes Captchas. Quite the contrary, most people hate when the annoying pop-up shows up, and you have to use your brain cells to solve a challenge when all you wanted to do was check out some fantastic places to visit in Prague.

So yes, Captchas can lead to a bad user experience, as it can break the flow of users.

Some users even end up abandoning the webpage altogether. This can negatively impact the viewership of a website, so website owners have to be careful with the Captchas not to deter the incoming traffic.

Also read: Best Real User Monitoring Tools to Improve User Experience

#2. Ineffectiveness

There is no guarantee that Captchas can deter bots from stealing your data, as bots have proven themselves to be as intelligent as humans repeatedly. So, on one hand, you have bots breaching your website, and on the other, you have frustrated users who continuously quit your website. It’s a lose-lose situation. 

#3. Not Viable for Visually-challenged Audience 

Unless you have the audio Captcha accompanying the main Captcha, they are unsuitable for the visually challenged audience. And this is only for the text-based Captchas. Other types, such as image-based, honeypot, and confident Captchas, rely on a human’s visual perception alone. So, people with impaired vision would have trouble accessing your site.

#4. Some Captchas are Hard to Read 

Certain text-based or even image-based Captchas are challenging to read or decipher. Despite repeated attempts, they can’t seem to figure it out. If your website visitors, despite being humans, can’t crack the code, they’ll quit your website in sheer frustration. This can again lead to decreased traffic. 

Closing Thoughts 

Captchas are one way humans are battling bots. They are finely curated tests that are meant to distinguish between bots and humans. With so many types out there, website owners have a range of options to choose from.

The hard truth is regardless of which Captcha you choose, your audience will hate you for wasting their time😂. So, you must be careful when using these security checkpoints. This post included everything you needed to know about Captchas. 

Next, learn about different Bot Detection and Mitigation Solutions to Keep Malicious Traffic Away.