I recently worked with a client running a high-traffic WooCommerce shop. They were getting hammered by registration spam, thousands of fake accounts a day. Their previous developer’s fix was a standard reCAPTCHA v2, the one that asks you to “Select all images with crosswalks.” The spam stopped overnight. So did about 15% of their legitimate conversions. We went through the session recordings and watched real customers, some using screen readers, others just baffled by the logic, fail the test three or four times and then give up. They were not bots. They were people who could not prove otherwise to a machine.
CAPTCHA is a reverse Turing test, and it assumes everyone interacts with the web the same way. It rests on visual and cognitive challenges, which makes it hostile to accessible authentication by design. If a user cannot read the distorted text, or cannot tell a bus from a van in a grainy 100×100 pixel square, they are locked out. Meanwhile, research cited in a Smashing Magazine article on the inaccessibility of CAPTCHA puts modern AI models at up to 100% accuracy on those image challenges. So the wall stops humans while the bots walk in the front door.
Why reCAPTCHA v3 is not the answer either
When I saw the conversion drop, my first move was to upgrade them to reCAPTCHA v3. It runs in the background, assigns a score, and never interrupts anyone. Within 48 hours it was flagging legitimate customers as “high risk” for using a privacy-focused browser or coming in through a corporate proxy. The scoring logic is a black box, so you have no way to tell the system that a given visitor is fine and simply on a VPN. That put us back at square one, and it made clear that accessible authentication needs a different approach rather than a better score.
Instead of puzzles, we moved the client onto a combination of magic links and Cloudflare Turnstile. Turnstile works because its challenges are non-interactive: there is no visual puzzle for the customer to solve, and the automated scripts still get filtered out. On the login side we added a simple magic link system. When the system is unsure about a visitor, it emails them a one-time link. That is secure, and unlike a puzzle it asks nothing of the user’s eyesight or motor control, so screen readers handle it without any trouble.
A better way to handle spam in WordPress
If you are still using image-based challenges, you are living in 2015. A honeypot is the easiest place to start. Bots are programmed to fill out every field they find, and a field hidden with CSS is invisible to a human, so anything that fills it is a script. Low-tech, and it works surprisingly well without bothering a single real user.
/**
* A simple honeypot check for custom WordPress forms
* Prefixing with bbioon to stay clean.
*/
function bbioon_validate_honeypot() {
if ( ! empty( $_POST['bbioon_hp_field'] ) ) {
// If this hidden field is filled, it's a bot.
wp_die( 'Bot detected. Please try again if you are human.' );
}
}
add_action( 'init', 'bbioon_validate_honeypot' );
Combine a honeypot with a service like Turnstile and most of your spam problem goes away at no cost to your accessibility score. Stop treating your customers like suspects and the conversion numbers follow. WCAG 2.2 is explicit about this: Success Criterion 3.3.8 tells you to avoid “cognitive function tests” for authentication.
What this comes down to
- Visual puzzles stop people. Modern AI bots get through them.
- Ignoring accessibility costs you conversions, not just goodwill.
- Use non-interactive challenges like Cloudflare Turnstile, or a server-side honeypot.
- Magic links and MFA are more secure and more accessible than asking someone to select the squares with stairs in them.
This gets complicated fast, especially when you are balancing security against UX. If you are tired of debugging someone else’s code and you just want your site to work for every customer, drop my team a line. We have probably seen it before.
So, are your customers still solving puzzles to buy from you? It might be worth a look at those logs.
