For starters, I strongly recommend against using captchas as they are not user friendly and have significant usability issues and make it harder for users to complete the form. To quote this article
Firstly, it is worth pointing out that captchas are nowhere near as
secure as you’d like to believe. Back in 2005, the W3C pointed out
that third party services had demonstrated that most captcha services
could be defeated with 88%-100% accuracy by using some simple OCR. I
suspect that since then captchas have probably gotten a bit better,
but spam bots probably have as well.
Then of course there are the accessibility issues. In particular,
visitors who suffer from blindness, dyslexia or low vision will
struggle greatly with a captcha system. You can aid them slightly by
offering an audio alternative, but the audio used in captcha systems
tends to be rather noisy and doesn’t help a great deal. Audio
alternatives are particularly useless if you are in a noisy
environment such as a coffee shop or office. To make matters worse,
these audio alternatives are often not provided in a way that is
accessible to the very audience that needs them the most.
Let’s assume, however, that all of our visitors have good vision.
Captchas are still the wrong solution because they put the onus on the
user to figure them out in order to successfully continue. Spam is not
the users problem, it is the problem of the business that is providing
the site. It is arrogant and lazy to try and push the problem onto a
Captchas cause a great deal of frustration for many users. On average,
it takes around 10 seconds to solve a captcha correctly. I have watched many a savvy user struggle 2, 3, even 4 times to correctly
solve a captcha. That’s no way to reward someone who is trying to
interact with your site.
There are alternative methods you can potentially look at which can make it easier for users to prove themselves as human without having to decipher the word entered and trying to determine whether its case sensitive or not
Some examples of those methods are
- The Honeypot method
The idea behind the honeypot method is simple: website forms would
include an additional field that is hidden to users. Spam robots
process and interact with raw HTML rather than render the source code
and therefore would not detect that the field is hidden. If data is
inserted into this “honeypot,” the website administrator could be
certain that it was not done by a genuine user.
- User Interaction:
One method getting a lot of attention has users perform tasks that are
impossible for virtual intelligence. They Make Apps features a small
slider that must be dragged to the right in order to submit a form. It
asks the visitor to “Show your human side; slide the cursor to the end
of the line to create your account.”
- Other Alternatives: Other alternatives worth looking at are
Other alternatives are Text CAPTCHA and Egglue, which ask
simple questions humans can answer using logic or intuition rather
than pattern recognition alone.
NuCaptcha uses behavior analysis to assess each visitor’s risk
level. Then it assigns easy or difficult CAPTCHAs based on how likely
it is that the visitor is a bot. Visitors who behave like humans are
given very easy tests to complete.
The downside of these options is that they still disrupt the user’s
workflow. While they might be less frustrating, they still create a
barrier between the user and their goal.