CAPTCHA.

CAPTCHA stands for 'Completely Automated Public Turing test to tell Computers and Humans Apart'. The first versions showed distorted letters; later came picture tasks such as 'Select all squares with traffic lights'. Because bots now solve such tasks well and people find them annoying, modern methods mostly work invisibly: they evaluate signals such as mouse movements, browser characteristics and behaviour, and only show a task when something looks suspicious.

The benefit is clear: unprotected contact forms, registrations and comment fields are flooded with spam by bots, and login forms are attacked with automated password attempts. A CAPTCHA reduces this noise and protects systems from abuse, for instance when a form triggers automated emails.

The drawbacks are often underestimated. Picture tasks are difficult or impossible for people with visual impairments and so run counter to the goals of accessibility. Services such as Google reCAPTCHA transmit visitor data to the provider, which has to be disclosed in the privacy policy under the Data Protection Act. And every additional script costs loading time. Every enquiry abandoned because of an unsolvable puzzle is a lost customer.

That is why a layered approach pays off. For many SME forms, invisible measures are enough: a honeypot field that only bots fill in, a minimum completion time, server-side validation of input and a limit on requests per IP address. Only when that is not enough is a data-minimising, invisible CAPTCHA added.