Guides and direct answers

CaptchaKit answers

Practical answers about arcade CAPTCHA and protecting forms.

Use cases

Install a replacement CAPTCHA plugin, remove the reCAPTCHA keys from your form plugin, enable the new one on each form, and test login, regi…

Send the visitor's token and your site key from your server to your CAPTCHA provider, never from the browser. With CaptchaKit, POST to https…

Use the lowest-friction check that stops your abuse. A honeypot catches simple bots, rate limits slow the rest, and a CAPTCHA is for forms u…

Partly. Google's reCAPTCHA Essentials tier is free for up to 10,000 assessments per calendar month across your whole organization. Past that…

Regulators have said yes in specific cases. France's CNIL, in deliberation SAN-2023-003 of 16 March 2023, found that reCAPTCHA cookies were …

A game CAPTCHA asks the visitor to finish a short mini-game instead of picking images or typing letters. CaptchaKit shows one of 18 arcade g…

Many CAPTCHAs are hard to use with assistive technology. WCAG 1.1.1 requires a text alternative that explains the CAPTCHA's purpose and an a…

Yes, several vendors say so. ALTCHA's open-source page says no cookies are set, Cloudflare says Turnstile processes only strictly necessary …

Often, but the published percentages are mostly vendor claims we could not trace to a primary study, so we do not repeat them. The reliable …

Any CAPTCHA that runs in the browser can be scripted by a determined attacker, and OWASP lists puzzle mini-games among the types attackers t…