Is CAPTCHA Still Enough to Stop Bots on My Website?

Short answer: A CAPTCHA is a speed bump. A September 2026 paper by two independent researchers shows free, locally run vision models (CLIP and OWLv2, no training, no API fees) solving Google's reCAPTCHA image challenges at a 92.6% per-session success rate. That is the puzzle-based fallback, the one your site probably still shows a suspicious visitor. Against harder, reasoning-style CAPTCHAs the picture is better for defenders: humans scored 93.3% on a 2025 benchmark of 20 modern CAPTCHA types, while the best AI agent tested managed 40%. So a plain image CAPTCHA no longer proves much about who is on the other end, and a well-designed modern one still makes an attack cost more. Either way, a CAPTCHA only judges whether one request looks human. It says nothing about whether the same visitor should be allowed to book 400 slots or create 4,000 accounts. For a small business or a public portal, treat it as the cheapest layer in the stack. And check accessibility before you pick one, because an image CAPTCHA has already been named in an ADA lawsuit against a small shop.

"We show that free and locally-run models can break Google reCAPTCHA"

That line is from the abstract of Robot Visions: Breaking reCAPTCHA at Zero Cost and Zero Shot, submitted to arXiv on 2026-09-16 by Suphannee Sivakorn and Samantha Gottlieb, independent researchers, and accepted at the 29th Information Security Conference (ISC 2026). The paper builds solvers entirely from open-source models: CLIP for one challenge type (58% per-challenge accuracy), OWLv2 for another (43.5%). Chained into a full pipeline, the system clears 92.6% of 500 real reCAPTCHA sessions, with no training, no paid API and no CAPTCHA-farm labor involved.

The cost is what changed. Earlier work the paper cites solved visual CAPTCHAs with commercial cloud vision models at $0.024 per challenge. Here, every experiment ran on a consumer laptop with no dedicated GPU, at $0 per solve. The authors also show a non-technical person can beat reCAPTCHA by giving plain-language instructions to a commodity AI assistant, which "collapses the practical attacker skill floor to near zero." Their conclusion is blunt: reCAPTCHA increasingly leans on reputation-based, invisible scoring rather than the visual puzzle, but that puzzle "persists as a safety net that, paradoxically, has become the weakest link in the defense chain," and challenge-based visual CAPTCHAs "may have reached the end of their useful life."

So is any CAPTCHA still genuinely hard for a bot?

Yes, some are, which is the detail that gets lost when a headline says "AI beats CAPTCHA." Open CaptchaWorld, a benchmark published 2025-05-30 by researchers including Yaxin Luo and Zhiqiang Shen, tested 20 modern CAPTCHA types across 225 puzzles against both humans and the leading multimodal AI models of the time (OpenAI-o3, Claude 3.7 Sonnet, Gemini 2.5 Pro, GPT-4.1 and others, each wired up with browser-control tools). Humans scored 93.3%. The best-performing agent, Browser-Use running OpenAI-o3, topped out at 40.0%. Puzzles that require several chained reasoning steps, not just naming an object in a photo, still stop most agents most of the time.

A second data point backs this up from the attacker's side. Oedipus: LLM-enhanced Reasoning CAPTCHA Solver, published on arXiv in May 2024 and later accepted at ACM CCS 2025, built a purpose-made pipeline against commercial reasoning CAPTCHAs from Arkose Labs, GeeTest and NetEase Yidun, the kind that ask you to rotate an object to point a certain way or line up matching items, rather than click "I am not a robot." With a framework built specifically to break these, the researchers reached a 63.5% average success rate using GPT-4 and 51.2% using Gemini. That took purpose-built engineering. In the same paper, GPT-4 and Gemini used directly, without the framework, solved only 12% to 21% of them.

Taken together, the papers point one way. Old-style image grids ("select all squares with a bus") are close to solved for free. Reasoning-heavy CAPTCHAs still cost an attacker real engineering effort and still fail often. The type of CAPTCHA you run matters more than whether you run one at all.

What Cloudflare Turnstile does instead of a puzzle

A common replacement for the image grid is Cloudflare Turnstile, which does not present a puzzle by default. Cloudflare's own documentation describes it as running "a series of small non-interactive JavaScript challenges to gather signals about the visitor or browser environment," including "proof-of-work (computational puzzles), proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior." It only escalates to something visible when the signals look weak. There are three widget modes: Managed, which decides for itself whether to show a checkbox; Non-interactive, which never asks the visitor to do anything; and Invisible, which stays hidden from the visitor.

The Free plan costs nothing: unlimited challenges, up to 20 widgets, 10 hostnames per widget, 7 days of analytics, per Cloudflare's plans page on 2026-09-23. The Enterprise tier, priced by quote, removes the Cloudflare branding, keeps 30 days of analytics and allows up to 200 hostnames per widget, per that same page. When Cloudflare made Managed mode free to everyone in its 2023-09-29 announcement, that was the pitch: stop making humans prove they are human, and measure the browser and the device instead.

Every check like this has a weakness that a 2014 Hacker News thread put well. In The No CAPTCHA problem (215 points, 96 comments, posted 2014-12-04 by user homakov, about Google's earlier move away from visible puzzles), user mseebach wrote that a home-made defense, such as a honeypot field or a "What's n+m?" question:

works at 100% until your site is valuable enough for the attacker to spend a couple of cycles to circumvent the honeypot - then it drops to 0%.

He was arguing that standard CAPTCHAs hold up better because breaking them takes more effort. The Robot Visions paper shows that effort for image CAPTCHAs has now dropped close to zero. That is why this series treats detection as something that buys you time. Pair it with a check that costs the attacker something real at the step that matters, such as the OTP send or the booking.

reCAPTCHA v3 and hCaptcha: same idea, different bill

Google's reCAPTCHA v3 works the same way conceptually: "reCAPTCHA v3 will never interrupt your users," returning instead "a score for each request without user friction," from 0.0 (very likely a bot) to 1.0 (very likely legitimate), with Google recommending a 0.5 threshold as a starting point and leaving the response, block, throttle, or add a second check, up to the site. Pricing, read from Google's billing documentation on 2026-09-23: free up to 10,000 assessments a month per Google Cloud organization, a flat $8 a month for 10,001 to 100,000, then $1 per 1,000 above that. Without billing enabled, requests over the free 10,000 return an error. For a small business's contact form or login page, this rarely costs anything.

hCaptcha sits differently. Its free Basic tier is the checkbox-and-challenge version. The "Low Friction 99.9% Passive Mode" is a feature of the paid Pro tier, which costs $139 a month billed monthly or $99 a month billed annually and includes 100,000 evaluations a month, then $0.99 per 1,000, along with custom themes and analytics. Risk scores and a fully passive "No-CAPTCHA" mode are Enterprise features, priced by quote. All figures are from hCaptcha's pricing page on 2026-09-23. If your priority is fewer visible puzzles at no cost, Turnstile or reCAPTCHA v3 get you there.

What a proof-of-work CAPTCHA buys you

A third family skips both puzzles and machine-learning scoring and makes the visitor's browser do real computational work before the form submits. ALTCHA is open source under the MIT license and self-hosted, and its README says it is cookie-free with no fingerprinting. Its GitHub description states it is "GDPR, WCAG 2.2 AA, and EAA compliant." Version 3, released on GitHub in April 2026, supports memory-bound algorithms (Argon2 and Scrypt) alongside the default hash-based ones. The project says these "neutralize hardware acceleration (ASICs/GPUs)," which raises the cost of solving thousands of challenges in parallel.

Anubis, from TecharoHQ, does the same job with a more aggressive posture. Its GitHub tagline is "Weighs the soul of incoming HTTP requests to stop AI crawlers." According to Help Net Security, TecharoHQ built it "in response to sustained automated scraping that placed heavy load on community run sites," and it makes the visitor's browser complete a proof-of-work challenge before a request is allowed through. Both tools are free to self-host. Neither charges per request, because the cost lands on the visitor's CPU, not on your invoice. A legitimate visitor pays a fraction of a second once. A script hitting the same endpoint 10,000 times pays 10,000 times.

Friendly Captcha runs the same proof-of-work idea as a hosted product. Its site, read on 2026-09-23, lists a free plan for non-commercial websites (1 domain, up to 1,000 requests a month), then Starter at €9 a month for 1 domain and up to 1,000 requests, Growth at €39 a month for 5 domains and 5,000 requests, Advanced at €200 a month for 50 domains and 50,000 requests, and Enterprise on request. For a commercial site, that is a monthly line item where ALTCHA or Anubis, self-hosted, cost nothing but your time.

"There is no way for a screen reader user to sign up or use any form that has a CAPTCHA"

That sentence is from a 2020-03-20 Shopify Community post by merchant Leighton_Tyau, titled I have a Shopify Store and I've just been sued under the ADA, describing a real federal ADA complaint (Gathers v. Wet Shaving Products LLC) against a two-and-a-half-person Shopify business. The newsletter signup's CAPTCHA was named specifically as a barrier. It is an old thread, and one merchant's account of one complaint, but the pattern it shows, a small shop installing a CAPTCHA plugin without checking accessibility, is easy to repeat.

Survey data shows why CAPTCHA keeps coming up. WebAIM's Screen Reader User Survey #10, fielded December 2023 to January 2024, asked screen reader users to rank the most problematic items they meet on the web. CAPTCHA came first, "by a notable margin," ahead of interactive elements that misbehave, links or buttons that do not make sense, and screens that change unexpectedly. Respondents with disabilities were twice as likely to rank CAPTCHA as a problem as respondents without disabilities.

The accessibility standard is specific about what fixes this. WCAG 2.1's guidance on Success Criterion 1.1.1 requires that where a CAPTCHA is used, "text alternatives that identify and describe the purpose of the non-text content are provided and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities," and recommends going further: offering more than two modalities, giving a route to a human who can bypass the CAPTCHA, and never CAPTCHA-gating a user who is already authenticated. India's GIGW 3.0 guidelines for government websites and apps carry the same CAPTCHA wording, and GIGW 3.0 conforms to WCAG 2.1 Level AA. In the EU, the European Accessibility Act has applied since June 2025. Its technical benchmark, EN 301 549, incorporates the WCAG success criteria, including 1.1.1. Fines are set by each member state. Per Level Access's summary, Germany can fine up to €100,000 for non-compliant products and services; France up to €50,000, plus €25,000 for related failures such as not publishing an accessibility statement; Italy up to €40,000, or up to 5% of annual turnover for companies already covered by its Stanca Law. Microenterprises that provide services (fewer than 10 staff and no more than €2 million in turnover or balance sheet) are exempt from the EAA's service requirements. Whether any of these laws applies to your site depends on where you operate and who you serve, so check with a lawyer before relying on this summary.

None of the modern replacements are automatically compliant. A visible image challenge on hCaptcha's free tier has the same accessibility problem a classic reCAPTCHA image grid does, unless an alternative in a different mode sits next to it. Proof-of-work tools start with an advantage, because most visitors have nothing to see or click. ALTCHA says it meets WCAG 2.2 AA and the EAA, and when it does need to show a challenge, its fallback is an "enter code from image" prompt with built-in audio. Cloudflare's plans page lists Turnstile as WCAG 2.2 AAA compliant on every plan. Those are vendor claims, so test them with a screen reader yourself. Even so, if accessibility matters to your site, invisible, proof-of-work or score-based checks are a better starting point than a visible puzzle.

Where this leaves a small business or a public portal

Put a low-friction layer at the front door: Turnstile, reCAPTCHA v3, or a self-hosted proof-of-work widget like ALTCHA, all free or close to it, all invisible to nearly everyone. Do not stop there. None of these layers verify identity, limit volume per person, or cost an attacker meaningfully more the second time they try. As the next post in this series covers, the real defense against spam and fraud sits one layer up: rate limits tied to an identity rather than an IP, a check placed at the step that costs you money (an OTP send, a booking, a payout) rather than at the page load, and a plan for what happens when someone clears the CAPTCHA and then keeps going. See How Do I Stop Bots From Spamming My Contact and Signup Forms? for that playbook, and What Does Bot Protection Cost a Small Business in 2026? for a price comparison of these tools and the enterprise tier. The broader argument for why "human vs bot" is already the wrong question is in the pillar post, Can You Still Tell a Bot From a Human Online?

What this actually costs

The disclosure first: Ready Bytes has not built a bot-protection product. We build web apps, back-office automation and integrations for owner-led businesses, the same pattern behind AI back office for small business. Nothing in this post is a case study, and we are not selling a CAPTCHA.

Most small sites should spend nothing here beyond a working afternoon: Turnstile or reCAPTCHA v3 are free at normal volume, and ALTCHA is free to self-host if you want to avoid a third-party script entirely. Where a build is worth paying for is fixing what a plugin got wrong: a CAPTCHA that shuts screen-reader users out of a form, a check placed at the front door instead of the step that costs you money, or a signup flow with no accessible fallback path at all.

If there is a scoped piece worth doing, here is the ladder:

• A free AI opportunity audit at /ai-audit: fifteen to twenty questions, about five minutes, no cost. Shyam reviews it and emails a written audit within two business days.
• A $500 full audit if the free one surfaces something: read-only access, your top 3 opportunities ranked by ROI, a 90-day roadmap and a fixed pilot quote, credited against the pilot if you proceed.
• A fixed-quote pilot, typically $3,000 to $8,000 over 2 to 6 weeks, scoped to one piece. Here, that would usually mean moving your highest-value form off a single front-door CAPTCHA onto an invisible check plus a value-step check, with a working accessible fallback, not a new CAPTCHA vendor for its own sake.
• An ongoing relationship after a pilot has proved itself.

Sometimes the most useful outcome of the audit is that you should not spend the money.

Start here

Do this on your own site this week, no tool required.

Open your busiest form (contact, newsletter signup, booking) in a fresh browser tab with your mouse unplugged and your monitor off, using only a screen reader or the keyboard. Try to submit it. If you hit a CAPTCHA you cannot pass without sight or a mouse, you have exactly the problem in the Shopify lawsuit above, and it is worth fixing before it is worth debating which vendor's solve rate is better.

Then check what happens after someone clears your CAPTCHA. Can the same visitor submit the form 50 times in a row? Create 50 accounts? If nothing stops that, the CAPTCHA was never your real problem. That gap is what the next post in this series covers.

---

Shyam Verma founded Ready Bytes in 2009 and has been building software since 2005. He writes about back-office automation, legacy modernization and applied AI at readybytes.in/blog.