There are a variety of different forms of CAPTCHA and other strategies in order to prevent spam. To briefly list a few:

  • Simple math or word questions.
  • Obfuscated text.
  • JavaScript-based CAPTCHAs.
  • Image CAPTCHAs.
  • Honeypots.
  • Audio CAPTCHAs.
  • Rule-based filtering like Akismet.
  • Gradual increase in privileges based on trust.
  • Community moderation like StackExchange.
  • Spam disincentives like nofollow attributes to links.
  • Incentives for posting good content.
  • Admin moderation.
  • IP whitelists and blacklists.
  • Public shaming and disgrace.

Each one of these approaches has obstacles to overcome due to accessibility issues, technical limitations, time restrictions, conversion problems, or size of community. The systems that I've seen working best are a combination of several of the above techniques. However, I can't help but feel as if we're missing something important when it comes to combating spam.

I know that it may be too much to wish for a single one-size-fits-all solution, but perhaps spam prevention could be approached from a different angle. I suspect that there may be more to explore in terms of the way the user interface influences human behavior.

I find that having constraints often triggers creativity, so given the following constraints, can we come up with any new tools to add to our arsenal against spam from a user interface perspective?

  1. It must be accessible.
  2. It must be non-disruptive and transparent to the end user.
  3. It cannot detract or distract from the primary purpose of the page.
  4. It must be automated or require very little moderation on a large scale.
  5. It cannot be a 3rd-party service.
  • You might find that the only thing satisfying all those requirements is no CAPTCHA at all. But I eagerly await answers from more creative people :) Nov 17, 2010 at 2:00
  • I just read a very interesting article on the matter a few days ago. It has creative alternatives, you should check it out webdesignledger.com/tips/why-you-should-stop-using-captchas
    – Pam Rdz
    Nov 17, 2010 at 2:27
  • 1
    Not within your constraints but for login situations just use open id. This takes care of a lot of spam problems. I usually no longer even register for sites without open-id. Nov 18, 2010 at 21:48
  • "Community censorship" sounds really ugly. No one is actually censored on SE/SO. Very few posts actually get deleted or have their content edited out. Spam filtering is just that--it's filtering. You wouldn't call Gmail's spam filters "spam censorship". Likewise, SO/SE simply uses collaborative filtering to emphasize high quality posts and de-emphasize low quality posts. It's similar to the PR system that Google uses where the "votes" are backlinks. Nov 18, 2010 at 22:43
  • Perhaps community moderation would have been better. I'll change it. Nov 18, 2010 at 22:48

6 Answers 6


I'm wondering if we can exploit some of the physical properties that differ between real people using browsers and spambots.

The two properties that come to mind for me are sequence and pace.

Sequence: A real person will download a page before submitting a comment; some spambots jump straight to sending a form submission.

Can we detect whether we've previously served the form to that user and reject submissions where they've not downloaded the form?

Pace: A real person will typically take a few seconds to a few minutes to enter their comment before hitting submit; a spambot might download the page and immediately submit the spam comment.

Is it reasonable to reject submissions that occur too quickly (say, < 2 seconds) or too slowly (say, > 24 hours)?

  • +1 - This is more the type of answer I was hoping for. Nov 18, 2010 at 22:55
  • 1
    For one form I worked on we kept track of the time (and other factors like repeated use of the same IP etc). Anything under 30 seconds was flagged as possible spam. If required you could then manually check the flagged as spam entries for possible humans.
    – Leah
    Nov 19, 2010 at 2:20
  • 6
    I think the form sequence verification is a pretty common default in the web frameworks of today, and is also easily circumvented by the bots by simply following the sequence. Nov 21, 2010 at 16:42
  • Interesting albeit short article here 90percentofeverything.com/2011/03/25/fk-captcha which I think is win.
    – saybeano
    Apr 9, 2011 at 0:54
  • 1
    As someone who's written bots (not spambots...), I can tell you that: a) some websites do do this, b) it doesn't work because the bot writer can work out that the website's doing it and program the bot to act realistically, and c) it hurts real users because it tends to slow things down and / or produce annoying false positives. Mar 5, 2013 at 4:17

While this seems like a flippant answer, XKCD actually had a conceptual solution to this problem, found here: http://xkcd.com/810/. In short, the alternate is to read an unrelated user comment and then indicate if the comment is constructive or not constructive. This has the bonus feature of preventing people from posting comments like "this sucks" and the like. That may or may not be desirable based on your intended use case, but I know I would like to see fewer of those.

This solution does have a few issues, such as how do you create a baseline set of constructive/not constructive comments that can be used as the testing set. Either someone must manually review these comments first, which fails to satisfy your 4th requirement, or you must create some sort of system to display "pending" comments to verified users (say 50 times or so) to get a consensus on the "correct" answer. Obviously, this assumes that the thing you are trying to use CAPTCHA alternatives to protect is a commenting system, and that you have enough users generating comments (or access to an unrelated set of comments) to have some actual baseline.

Edit: While my brain was engaging (I haven't had my tea yet), depending on the length of the comments, you could display more than 1 comment to be indicated as constructive or not, which allows you to seamlessly present the "pending" comments to users to reach your consensus on that comment without anyone feeling like they had to do extra work.

  • +1 - I don't think that this satisfies points 2 and 3, but it's an interesting twist on Recaptcha. If you have to make them answer something, why not make it useful to you? Do you or anyone else have other ideas that might not be so subjective that could actually benefit a site? Recaptcha is great, but I don't know how much of us actually benefit from it. I've started to hear things about captchas with advertisements as well. Nov 21, 2010 at 18:03

To have money is human

The most effective solution I've ever encountered for differentiating between robots and people is to be aware of whether or not they have spent money on the internet.

To use an email as a common account identifier for this example. If you know that email has ever purchased any item online, whether it be from you, a competitor, amazon or any digital marketplace, you can be 100% certain they are a human, and not a spam bot.

This works today, and will never stop working because the cost of purchasing an item will always exceed the value of the spam that can be posted afterwards, making spam no longer economically feasible.

This is not very doable for many people who don't operate in e-commerce or related industries, but in situations where you do have that data, you have a flawless way to identify if a person is human. No more prompting them with tricky questions.

  • 2
    Is there anybody besides Amazon that has data on whether a given Email purchased on Amazon?
    – Christian
    Jan 17, 2014 at 14:37
  • I don't believe so. I named Amazon only to demonstrate the possible scale of such a solution. If you did have that data, you'd probably prompt less than half of the humans you ever encounter, if not better. Jan 17, 2014 at 22:38
  • Not 100 percent certain. Ticketmaster uses CAPTCHA to prevent scalper bots from buying event tickets. Humble Bundle uses ReCAPTCHA as well for some reason, despite its side effect of blocking customers in China from spending money. Jan 9, 2016 at 18:08
  • Scalping is an interesting problem that my solution doesn't fully address because it can be highly profitable (with a higher demand for capital and risk of loss). My solution wont stop it, but a CAPTCHA will do nothing to stop it either. The obvious way to address scalping would be to require names be printed on tickets at time of purchase, but thats outside the scope of this issue in my opinion. Jan 10, 2016 at 4:57
  • What about first-time buyers ? )))) They're f*ed with this method... A chicken and egg problem...
    – Quandary
    Nov 11, 2016 at 8:12

I am interested in exploring/revisiting this thread, and would like to know if this could work or not given the current technology:

  1. Users are presented with an image of the world map, where the image can be randomly shifted horizontal across the screen each time so that you can just remember the geographical position as a co-ordinate position on the image.

  2. Users are asked a question "e.g. where are you in the world at the moment" related to a geographical position that can be verified (e.g. through an IP address or machine address).

  3. User input is matched to the image and if the answers match then the captcha is complete.

I think it is fast, can probably be made accessible, but probably still requires javascript processing. But it only relies on processing from the user and very quick and simple response that can't be reliably simulated by the bots (or can it?). I am also exploring some ideas with gesture based captchas, but I don't know if there are specific problems with this as well.


What if a small game was used as a test? A simple puzzle that keeps users entertained so they don't really notice it's for spam prevention... like a simplified version of Crayon Physics.

  • 3
    I don't see how that could be used as a CAPTCHA. Sure, it'd be nice if the CAPTCHA were fun. But there aren't any that are, except for maybe photo CAPTCHAs. Also, you don't want the CAPTCHA to take as long to complete as writing a comment or whatever the user is actually trying to do. There aren't too many fun games that you can play in under 10 seconds, which is about how long a reCAPTCHA takes to solve (usually far less; more around 3-4 seconds). Nov 19, 2010 at 17:19
  • It doesn't have to be fun, just mildly entertaining. Simple things like "move this object here" or "draw this shape mirrored" would be pretty quick and easy.
    – user2588
    Nov 19, 2010 at 17:43
  • 1
    Fair enough, but how would those tasks identify a user as human/computer? Mouse movement and typing pattern can be used to identify specific users, but I'm thinking that it would be very easy to replicate a random user's typing/mouse patterns by machine. Nov 19, 2010 at 19:09
  • 4
    Another roadblock is that it would probably have to be implemented in JavaScript, Flash, or Silverlight; all of which can be turned off and could present accessibility issues. Nov 19, 2010 at 19:23
  • 1
    I'd say accessibility is gonna be one of the main obstacles there — a partially-sighted user is going to be unable to do any of those things. Even relatively-young, accomplished users wouldn't always be able to complete them — I'm 36 and have been using the Web since 1993, but have a tremor in my hands, so wouldn't have the acuity to "draw this shape mirrored", for example. Mar 6, 2012 at 18:11

Analysis of social activity may be helpful.

For example, if someone logged in to your site using Facebook connect, and you see that they've been registered for 3 years, have 50 friends and a photo of their cat in the gallery, you can ask that user for CAPTCHA only occasionally.

On the contrary, if a user was registered on Facebook yesterday and has exactly 256 friends (just kidding), you may want to ask him to enter CAPTCHAs the first 10 days or so.

Of course, this approach relies on the ability of Facebook/Google/etc. to remove hijacked accounts rather quickly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.