“Should I put a CAPTCHA on my login form?”
Should I put a CAPTCHA on my login form?
Short answer
A CAPTCHA can slow automated login attempts, but it is one layer, not the fix. OWASP calls multi-factor authentication the strongest control against most password attacks and lists a CAPTCHA only among traffic mitigations. Use a CAPTCHA alongside rate limits, breached-password checks and MFA, and challenge suspicious logins rather than every login if you can.
Steps
- 1
Turn on MFA
Offer or require a second factor. OWASP names it the strongest single control.
- 2
Rate limit the endpoint
Limit by IP, by account and by device so one signal cannot be dodged.
- 3
Check passwords against breaches
Reject passwords that appear in known breach lists at signup and reset.
- 4
Add a CAPTCHA to risky logins
Challenge when other signals look automated, and verify the token on the server.
- 5
Watch the results
Track solve and failure rates. A sudden jump can mean automated solving.
Brute force and credential stuffing are different
Brute force guesses passwords for one account. Credential stuffing takes username and password pairs leaked from other sites and tries them in bulk, hoping people reused a password. OWASP describes it as automated tools submitting stolen login pairs to login forms.
The difference matters because defenses aimed at guessing, such as locking an account after a few failures, do little against stuffing. Each account sees only one or two attempts, so no single account crosses the lockout line.
What a CAPTCHA adds to a login
A CAPTCHA raises the cost of each automated attempt. The attacker needs a solver for every try, which cuts the speed of a bulk run. OWASP's credential stuffing guidance lists CAPTCHA among the ways to mitigate abusive traffic, and says blocking or CAPTCHA decisions should weigh several abuse scenarios rather than one predictable volume limit.
OWASP is also plain about the limits. Its Authentication Cheat Sheet notes that CAPTCHAs can be solved automatically or outsourced, so they belong in a defense in depth plan, not at the center of it. See can AI solve CAPTCHAs for what the research shows.
Where MFA wins
With a second factor, a correct leaked password is not enough to get in. OWASP's credential stuffing guidance calls MFA the strongest control against most password attacks and says to implement it wherever possible. A CAPTCHA does nothing for an attacker who already holds a valid password and a solver.
If you cannot require MFA for everyone, OWASP suggests layering other defenses and requiring MFA at least for administrators.
A layered login setup
Start with the controls that cost real visitors nothing: rate limits on the login endpoint, breached-password checks and MFA. Add a CAPTCHA where those signals flag a session, such as a burst of failures from one network or a login from a new device.
If you do show a challenge, verify the token on your server before checking the password, and treat a missing or reused token as a failed login. The steps are in how to verify a CAPTCHA token on your server. Pick a challenge that people can complete with a keyboard or a screen reader, as covered in are CAPTCHAs accessible.
What CaptchaKit does here
CaptchaKit's WordPress plugin can protect the WordPress login form. On a custom login form you add the widget and verify the token with `POST /api/verify` from your server. It does not replace MFA, rate limits or breached-password checks, and it does not claim to.
Questions
Does a CAPTCHA stop credential stuffing?
It slows it. A CAPTCHA raises the cost of each attempt, but attackers can use solvers or human farms, so OWASP treats it as one layer among several.
Should I show a CAPTCHA on every login or only suspicious ones?
Only suspicious ones, when you can tell them apart. Challenging everyone adds friction for people who did nothing wrong. Trigger it on bursts of failures, new devices or other automation signals.
Is rate limiting enough?
Not by itself. OWASP warns that blocking by IP address may stop simple attacks but should not be the sole or primary defense, since attackers spread attempts across many addresses.
Do account lockouts stop credential stuffing?
Mostly no. Stuffing tries one or two passwords per account, so lockout thresholds are rarely reached.
Does a CAPTCHA replace MFA?
No. MFA protects an account even when the password is correct. A CAPTCHA only makes automated attempts more expensive.
Can bots solve CAPTCHAs?
For some types, yes. Published research and OWASP both describe automated solving and paid human solving. See can AI solve CAPTCHAs.
What does the CaptchaKit WordPress plugin do on login?
It adds a game to the WordPress login form and verifies the token on the server before the login proceeds.
Sources
- OWASP Credential Stuffing Prevention Cheat Sheet (checked 2026-10-18)
- OWASP: Credential stuffing (checked 2026-10-18)
- OWASP Authentication Cheat Sheet (checked 2026-10-18)
- CaptchaKit documentation (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.