Yes. A captcha stops some real people from finishing your form, and it stops fewer bots than you would expect. On a plumbing or roofing site, a visible puzzle is usually the wrong thing to add.
Who actually gets stopped, and for how long
The W3C, the body that writes the standards the web runs on, published a note called “Inaccessibility of CAPTCHA”, subtitled “Alternatives to Visual Turing Tests on the Web”. It is a W3C Group Draft Note dated December 16, 2021.
It does not hedge. It says such tests “fail to properly recognize users with disabilities as human, obstructing their participation in contemporary society.”
On the squiggly text kind, it says that “asking users who are blind, visually impaired or dyslexic to identify textual characters in a distorted graphic is asking them to perform a task they are intrinsically least able to accomplish.”
The audio button is meant to be the way around that. The same note, citing a CNet report from 2003 titled “Spam-bot tests flunk the blind”, describes a test where Hotmail’s sound output “was unintelligible to all four test subjects, all of whom had good hearing.”
Read that one carefully before you repeat it. Four people is a tiny test, and 2003 is a long way back. It tells you the audio fallback can fail badly. It does not tell you how often.
The same W3C note reports that “an average of 32 seconds are required for a user to complete a CAPTCHA.”
Half a minute is a long time to hold a homeowner standing in a wet kitchen with three roofers open in three tabs.
Now the honest part. The note credits that figure to software developers at Cloudflare, a company that sells an alternative to captchas. It is a time measurement, not a walk-away measurement. We have found no published count of how many people abandon a contractor’s quote form when a puzzle appears.
So treat 32 seconds as a cost you are choosing to add. Do not treat it as a lost-jobs number. Anyone who quotes you a lost-jobs number for your own trade in your own town cannot show you the study behind it.
Bots are better at the puzzles than your customers
This is the part that changes the decision.
Six researchers, Searles, Nakatsuka, Ozturk, Paverd, Tsudik and Enkoji, published “An Empirical Study & Evaluation of Modern CAPTCHAs” at USENIX Security 2023. The preprint went up on July 22, 2023. They ran a study in which “1,400 participants collectively solved 14,000 CAPTCHAs.”
Their finding on machines is short and worth reading twice: “The bots’ accuracy ranges from 85-100%, with the majority above 96%. This substantially exceeds the human accuracy range we observed (50-85%).”
Go check those two ranges yourself. The machines score higher than the people. The puzzle taxes your customer and waves the software through.
The W3C note points the same way on audio. It says a study at the University of Maryland “has demonstrated 90% success rate cracking Google’s audio reCAPTCHA using Google’s own speech recognition service.” Read the end of that line twice. Google’s own speech-to-text beat Google’s own audio test. The note calls the study recent and the note is dated 2021, so the finding is older than it looks.
If you keep one, the standard asks for two things
WCAG 2.2 became a W3C Recommendation on October 5, 2023. The version on the W3C site now carries the date December 12, 2024. Success Criterion 1.1.1, Non-text Content, has a bullet written for exactly this case.
It says that where non-text content exists “to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.”
In plain terms: say what the thing is for, and offer at least one other way through that uses a different sense.
WCAG is a standard published by the W3C. It is not, on its own, a United States law. Whether any accessibility rule binds your business is a legal question, and the answer turns on federal rules and on your own state. This is not legal advice. Ask your own attorney and check your state’s rules before you decide you are covered.
The invisible check hands you a number, not a verdict
The common answer now is a score-based check that shows nothing. Google’s reCAPTCHA v3 developer documentation, last updated 2024-07-10 UTC, says it “will never interrupt your users, so you can run it whenever you like without affecting conversion.”
Instead of a puzzle it returns a score, where “1.0 is very likely a good interaction, 0.0 is very likely a bot.” The page suggests a starting point: “By default, you can use a threshold of 0.5.”
Here is where installers get it wrong. That page also says “Based on the score, you can take variable action in the context of your site.” It hands you a number and stops. What happens to a message scoring 0.4 is your call, and by default nothing happens at all.
The same page notes that reCAPTCHA “learns by seeing real traffic on your site.” A form that gets twenty fills a month is not giving it much to learn from.
So do not wire it to silently bin everything under 0.5. You will throw away real customers and never see it happen. Let every message reach you, and use the score to sort, not to delete.
Cloudflare’s own Turnstile documentation, last updated April 16, 2026, describes a similar approach. Its managed mode “automatically chooses between non-interactive or checkbox challenge based on visitor risk level”, with “no images or text to decipher”. The same rule applies. It is a filter, not a judge.
The free thing to try before you buy anything
The W3C note has a section on honeypots. It describes a check “visible to robots but not to humans”, and says “The form is created to attract robots and then hidden from the user by markup such as CSS-Hidden.” It adds that this “is easily implemented even in hand authored markup and should be considered.”
A bot fills every field it finds. A person never sees the hidden one. If it comes back filled, drop the message.
Two cautions. Hide it in a way screen readers also skip, or you have built a trap for the exact people the W3C note is worried about. And a honeypot catches simple bots, not a person paid by the hour to type.
Then shorten the form. Every extra box is another chance to quit, so how many boxes to keep is its own question, as is whether to run a form at all.
And check what you are actually fighting. If real leads are missing rather than junk arriving, a captcha fixes nothing, and the next place to look is your form emails landing in junk.
What to do this week
- Count the junk. Two a week is not a problem. Delete them and buy nothing.
- If a visible puzzle is already on your form, fill your own form in on your phone, one-handed, in a truck. Time it.
- Take the visible puzzle off and add a hidden field first. Watch the junk for two weeks.
- If junk is still heavy, add a score-based check and route low scores to a separate folder. Read that folder.
- Never auto-delete on a score. Sort on it.
- If you keep any visible check, give it a written label and a second way through.
Aim for a form that is short and honest rather than one with a gate in front of it. A website built for a trade should ship with the hidden field already in place and no puzzle for the customer to solve.