CAPTCHA and accessibility: who gets locked out of your contact form

What the accessibility standard says

W3C first published its note on the Inaccessibility of CAPTCHA in 2005 and updated it as a Working Group Note in 2019 [1]. Its central point: every interactive CAPTCHA asks the user to perform a task, and the very nature of that task excludes many people with disabilities, which amounts to denying them the service. The note also observes that many popular CAPTCHA techniques are no longer particularly effective or secure [1].

The Web Content Accessibility Guidelines (WCAG) go as far as saying CAPTCHAs deliberately push the edges of human ability, so that every type will be unsolvable for users with certain disabilities [2]. WCAG still permits CAPTCHAs, but only with a text description and an alternative form using a different sense, such as an audio version alongside an image. It permits them largely because banning them outright would push websites to ignore the guidelines altogether [2].

Who gets locked out

• Blind and low-vision visitors: image grids and distorted text are unusable with a screen reader, and hard with magnification.
• Deaf and hard-of-hearing visitors: the audio alternative doesn't help them, and the visual one may not either.
• People with motor impairments or tremors: dragging a slider precisely, or tapping small image squares, can be impossible.
• People with dyslexia or cognitive impairments: distorted letters and multi-step image tasks are exactly the kind of task that is hardest for them.
• Older visitors: in the 2023 study of 1,400 people, solving time rose with age for all CAPTCHA types [4].
• People reading in a second language: in Stanford's large study, participants outside the US took longer on English-language CAPTCHAs [3].

W3C also points to situational barriers that affect anyone: a small phone screen, bright sunlight, or a noisy place where audio can't be heard [1].

Why the audio option doesn’t fix it

Audio CAPTCHAs are the usual answer to "what about blind users?". The research is not kind to them. In Stanford's study of more than 1,100 people, three listeners agreed on an audio CAPTCHA's answer only 31% of the time, and each one took an average of 28.4 seconds [3]. And the audio version gives bots an easier way in: researchers defeated reCAPTCHA's audio challenge with off-the-shelf speech recognition [5].

So the accessibility option is at once the hardest version for people and one of the easiest for machines.

What about the "I’m not a robot" checkbox?

The checkbox is easier for most people than image grids, and W3C notes anecdotal evidence that it can be used with a range of assistive technologies. But when the background check isn't satisfied, it falls back to the same image or audio challenges [1]. Those fallbacks are more likely for people with unusual browsers or privacy settings, and assistive technology can itself make a browser look unusual. A visitor can't know in advance which version they will get.

Accessible ways to stop spam

W3C's note reviews approaches that don't ask the visitor to solve anything, including hidden "honeypot" fields and checks based on how the form is used [1]. For a contact form, the practical combination is:

1. A hidden trap field, hidden correctly: out of view, skipped by the keyboard, and hidden from screen readers too, so no real person ever meets it.
2. A minimum time before a form can be sent.
3. A signed one-time token proving the form was started on your page.
4. Link rules and a rate limit.

If you want one visible step, give it a keyboard and screen-reader alternative. Our slide-to-send control, for example, has a "press here to send" button that works with a keyboard and is announced correctly by screen readers. Nobody should need precise dragging to contact a business.

Why it matters for your business

Beyond fairness, it is simple arithmetic: every customer who can't get through your form is an enquiry lost, and they rarely tell you. Accessibility is also increasingly a legal expectation for business websites in many countries, so an inaccessible form can be a compliance risk as well as a lost sale. Check what applies where you operate.

The wider research on lost customers is in is CAPTCHA costing you customers?