CAPTCHA Basics: What Are CAPTCHAs and Why Do Websites Use Them?

If you have ever logged into a website, created an account, or posted a form online, you have almost certainly met a CAPTCHA. That little puzzle that asks you to identify traffic lights, retype a word, or click a checkbox before you continue is there for a reason.

This is the first article in our Learning Path series. We start from zero and build up to advanced CAPTCHA automation, step by step.

What Does CAPTCHA Mean?

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. Despite the long acronym, the idea is simple: it is a test that computers should fail and humans should pass.

The name comes from the famous Turing test, which asks whether a machine can imitate a human. A CAPTCHA is the reverse: the website plays the role of the tester, and it challenges the visitor to prove that a human is present.

Why Do Websites Use CAPTCHAs?

CAPTCHAs are a security layer. They protect websites from automated abuse such as:

• Spam: bots posting fake comments, reviews, or forum messages.
• Fake accounts: automated mass registration of disposable accounts.
• Credential stuffing: bots trying stolen username/password pairs in bulk.
• Data scraping: automated scripts harvesting prices, listings, or content at scale.
• Resource abuse: bots inflating vote counts, ad clicks, or inventory reservations.

When a website cannot reliably tell a human from a bot, a CAPTCHA gives it a second line of defense.

The Main Types of CAPTCHAs

CAPTCHAs come in many flavors. The most common ones you will meet:

• Text CAPTCHAs: distorted letters and numbers that must be typed correctly.
• Image CAPTCHAs: select all images containing a bus, a storefront, or a crosswalk.
• Checkbox CAPTCHAs: the famous "I am not a robot" checkbox from reCAPTCHA v2.
• Invisible CAPTCHAs: like reCAPTCHA v3, they run in the background and score the visitor without any visible challenge.
• Custom puzzles: sliding puzzles, click-and-hold tests, or logic questions used by providers such as GeeTest, hCaptcha, and Cloudflare Turnstile.

How CAPTCHAs Actually Protect a Site

When a CAPTCHA appears, the website generates a unique challenge and sends it to the visitor's browser. The browser renders it, the visitor solves it, and the answer is sent back. If the answer is correct, the site issues a token that grants access to the action being protected.

That token is short-lived. It is tied to the specific page, session, and action, so it cannot simply be copied from one site and reused on another.

The Catch for Legitimate Automation

CAPTCHAs do not only block malicious bots. They also block legitimate automation: web scrapers collecting public data, RPA robots processing invoices, QA tools testing logins, and developers integrating with third-party sites. When your script hits a CAPTCHA, the workflow stops until a human intervenes.

That is exactly where CAPTCHA solving services come in, which is the topic of the next article in this Learning Path.

Key Takeaways

• A CAPTCHA is an automated test that tells computers and humans apart.
• Websites use them to stop spam, fake accounts, credential stuffing, and scraping abuse.
• CAPTCHAs range from simple text puzzles to invisible background scoring.
• They also block legitimate automation, creating the need for solving services.

In the next article we look at how CAPTCHA solving services work under the hood.