9

While I understand this is probably a very broad question, I'm trying to figure out exactly when adding a CAPTCHA becomes a necessary requirement for a site. I get the sense a lot of clients ask me to add CAPTCHAs to their sites and not all of them require it. However, I'm not always as eloquent on this topic as I should be.. Maybe it might help if a response contained answers to questions like these:

  • What kinds of web sites should absolutely have CAPTCHAs?
  • What kinds of web sites should consider using CAPTCHAs, but not necessarily always adopt them?
  • What kinds of web site should go without CATCHAs, since there are very few incentives to having such a barrier?
Improve this question
8
  • 2
    Here's a couple of threads on CAPTCHAs: ux.stackexchange.com/questions/14833/… and ux.stackexchange.com/questions/2530/…
    – agib
    Commented Jan 3, 2012 at 8:47
  • Not really an answer, but its a good idea as it helps to translate books youtube.com/watch?v=cQl6jUjFjp4 :D
    – invalid_arg
    Commented Jan 3, 2012 at 9:22
  • Whenever you need to filter humans. @invalid_arg re Captcha is the one that "reads books"
    – Naoise Golden
    Commented Jan 3, 2012 at 10:46
  • @NaoiseGolden true, so better to use that instead :D
    – invalid_arg
    Commented Jan 3, 2012 at 11:03
  • 5
    There's also lovely irony in reCAPTCHA being used to help translate books. The idea of a CAPTCHA--which is designed to prevent computers from reading it--being used to improve what computers can read is a bit of a contradiction in terms of goals.
    – DA01
    Commented Jan 3, 2012 at 18:56

8 Answers 8

Reset to default
8

The CAPTCHA is a good idea where any bot online can and would sign up and/or post to your site.

Wikipedia says CAPTCHAs are used in attempts to prevent automated software from performing actions which degrade the quality of service of a given system, whether due to abuse or resource expenditure. [...] CAPTCHAs are also used to minimize automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism.

Addressing your questions:

  • Sites harrassed by automated posts.
  • Sites vulnerable of automated posts but avoiding them in other ways than captchas.
  • Sites not vulnerable to, or effectively avoiding, automated posts in other ways than captchas.
Improve this answer
3
  • This is a technical answer, rather than a UX answer. Barring no other option, a CAPTCHA would make the UX better for OTHERS, but in general, a CAPTCHA is an annoying UX for the users that have to deal with them.
    – DA01
    Commented Jan 3, 2012 at 18:51
  • @DA01 Well, of course no one adds CAPTCHA's to improve UX! The only purpose they serve is technical security. I agree they should be used judiciously (and are a PITA for users), but none of the security bag-of-tricks are good UX. Repeat attempt timeouts, account lockouts, bot-sniffing algorithms, etc. are all trying to solve technical problems, and all hinder UX to some degree. The real question is in a given situation with a given security requirement, how can the UX be least hindered. Also, an overzealous account lock or attempt timeout can be far worse than a CAPTCHA.
    – peteorpeter
    Commented Jan 4, 2012 at 5:37
  • I mostly agree, though note that CAPTCHAs aren't security tools. They are readily circumvented. They are merely a hurdle to make it a little easier for the site admins. I
    – DA01
    Commented Jan 4, 2012 at 15:21
7

What kinds of web sites should absolutely have CAPTCHAs? None, unless you can have a solid proof that the website will be victim of bots, and you can't possibly deal with this issue by other means which do not decrease the user experience as CAPTCHA does.

Other means

  • Consider your bank account. One way to prevent hacking is to add a CAPTCHA to the logon form. From the UX point of view, it is a disaster: imagine you typed a wrong CAPTCHA. Now you have to retype your 12 characters length password again. Quite annoying.

    Instead of using CAPTCHA, the website can restrict the number of failed attempts to 3 per hour from same IP/to same account, use proper audits to track hacking attempts, etc.

  • Consider Stack Exchange websites. I would be angry if those websites will ask me to type a CAPTCHA every time I want to ask a question, post an answer or comment something. But on some Stack Exchange websites I use the most, I have enough reputation to never see the CAPTCHA appear, and even the new users see the CAPTCHA only in some cases, not on every posts.

    In general, don't ask to fill the CAPTCHA again and again. If you found that the user is a human five minutes ago, there are chances that this is still an human now.

  • Use the technical power to find the bots. An human being cannot open a page, type a long message in 0.1 s. and send it. If a user is so fast, discard his submission and ask him gently to take his time, and to post it again after a few seconds.

  • Use your community. The power of Stack Exchange sites is that you can come, as an human, and post some advertisement or whatsoever. On the most frequented sites, your questions would be immediately flagged and closed by users with enough reputation, than removed by moderators.

    If on your website a new message from a new user is flagged by three older users, hide it until further review by yourself. If it's flagged by a single user who posted over ten thousand comments on your website, hide this message directly, without waiting for two other flags.

Remember: there are plenty of websites with no CAPTCHA (or a not very intrusive CAPTCHA), and no spam (Stack Exchange is a perfect example). If they can do it, you can.

Improve this answer
3
  • Many social network/online community sites are subject of bot attacks, and they use CAPTCHA because it's the most efficient way of preventing this in large scale.
    – AndroidHustle
    Commented Jan 3, 2012 at 9:51
  • upvoted! what is your opinion about "I am not a robot" checkbox that sites have on their login pages
    – PirateApp
    Commented Jul 17, 2019 at 7:22
  • 1
    @PirateApp: I don't know how it is implemented (it tracks cursor movement, I suppose, and do some AI to differentiate between chaotic motion from a user from an app which tries to simulate chaos?) From user's perspective, it's less terrible than CAPTCHA, but still annoying. There is a much better alternative with reCAPTCHA v3, which should be completely invisible to the user most of the time, and which is therefore a clear win from UX perspective.
    – Arseni Mourzenko
    Commented Jul 17, 2019 at 8:20
1

Consider CAPTCHA implementation for any site...

  • that has login and high traffic or is expected to have high traffic. The more people the site reaches, the greater the chance someone will want to mess with it.
  • with a web operation that requires a large amount of the web server's processing power or resources. Bots doing these calls repeatedly could be trouble
  • involving money.
  • involving a reputation system. It's not money, but considering the amount of time some users spend on particular sites, it's close.
  • that reaches groups that have known reasons to exploit it. If the site revolves around a hot topic, then it might not matter how much traffic goes through it. People may be actively seeking sites like yours to screw with it.

If you determine that a site should have CAPTCHAs, here are some usage suggestions that I didn't see mentioned yet:

  • During account creation.
  • During login after X number of failed login attempts in a row.
  • If previous attempt was a failed login, avoid users having to retype any information if only the CAPTCHA was incorrect.
  • Before an operation that puts significant load on the server.
Improve this answer
1

"When is it a good idea" - never, from a UX perspective. "When is it a valid thing to use despite this" - when the significant UX dowside is justified by the importance of ensuring that a human being is entering the data, not a bot.

Your question is actually the wrong one. The issue is not about when you should use CAPTCHAs, the question is what are the critical issues for this site. If it is good UX, then never, if it is validity of the users or data, then CAPTCHAs are one option, although there are others depending on the nature of the solution and issue. Focussing on one particular solution is the wrong approach - and you would do better to respond to your users asking them what they expect CAPTCHAs to do. And solve their actual problem, not the one they think they have.

Improve this answer
1

From a user experience perspective, there are approaches to CAPTCHA that are much more human-friendly than those awful, distorted text captchas. I've seen ones out there where the user has to click on some specific pictures, or solve a little game that requires them to identify which two objects belong together, etc. I think those types of CAPTCHAs provide for a better user experience.

Improve this answer
1
  • The question seems to be asking about situations in which these systems are used. Which sorts of sites might benefit from these alternatives, and why?
    – kastark
    Commented Oct 12, 2012 at 9:03
0

Make a list of all the sites that you visit where you, as a user, enjoy filling out the CAPTCHA.

I'll give you a few minutes.

Done?

I'm guessing your list has zero items.

Yea, from a pure UX perspective, having users deal with CAPTCHAS is always a bad idea.

Sometimes its necessary due to an inability to control automated posts via other technology or admins, and in that case, it's become an accepted necessary evil.

Improve this answer
0

Let me make it simple for you. If you think that at some point somebody/somewhat will try and spam/flood you with irrelevant data (comments, fake user accounts, corrupt files, etc.) is when you should implement CAPTCHA.

For me, I am building an app that I know that sooner or later I will have "attacks" and that's why I low some risks by just adding a captcha system to my signup page.

Improve this answer
0

Never!

Why should a person confirm to a computer that he indeed is a person. Yes, I totally get the technical reasons why captchas are needed, but they are bad UX.

Take a look at this video, from the Google Analytics team, for a person's interaction with a captcha (it's at the 1:02 mark):

Google Analytics In Real Life - Online Checkout

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.