How Effective Is CAPTCHA? Does It Really Stop Bots?

CAPTCHA has been the web’s default bot check for decades. The logic was simple: if a visitor could solve a puzzle, they were probably human. That logic no longer holds, as AI-powered bots and purpose-built CAPTCHA farms are designed to pass challenges at scale.

Here’s what’s actually happening with CAPTCHA today, and what effective bot protection looks like instead.

How effective is CAPTCHA?

Although CAPTCHAs and reCAPTCHAs have protected content and revenue for online businesses for years, they’re no longer effective. Previously, businesses believed if a visitor could read distorted text or pick out fire hydrants in a grid of photos, they were likely human. That assumption has aged badly.

CAPTCHAs rarely stop bots on their own, because modern AI solves image-recognition puzzles with 90%+ accuracy. And for anything AI can’t handle automatically, CAPTCHA-solving services charge as little as $1–3 per 1,000 solves—cheap enough that bypassing puzzle-based challenges has been fully industrialized.

The result: roughly half of the traffic that successfully solves a traditional or third-party CAPTCHA is bot traffic, not human. The “pass” signal alone is close to a coin flip against sophisticated bots.

In June 2026, DataDome’s Galileo Threat Research team stopped a purpose-built CAPTCHA farm attacking a ticketing platform’s checkout flow. The attackers made 18.8 million bypass attempts in roughly 24 hours, run from a botnet of 3.2 million IP addresses across 22,000+ autonomous systems. Every attempt was blocked before a single ticket reached a scalper. Even so, this attack demonstrates the scale at which attackers attempt to pass verification methods.

But beyond security gaps, traditional CAPTCHAs have serious accessibility issues. For people with dyslexia, visual impairment, or sensory disabilities, text- and image-based puzzles can be impossible to complete. The checkbox reCAPTCHA helped, but users relying on screen readers still struggled. And when detection wasn’t confident, they got sent to an image-recognition step anyway.

Traditional CAPTCHAs kill conversions

Even the most efficient CAPTCHA is an interruption when it appears in front of a real human. Someone ready to sign up, submit a form, or make a purchase doesn’t want another step, and frustration caused by a CAPTCHA might be the reason they don’t complete their intended action.

It’s difficult to tell just how much traditional CAPTCHAs kill conversions. However, according to Acquireconvert, when the video app maker Animoto ran a test on their sign-up form, the form that included a CAPTCHA converted 48%, compared to 64% for the non-CAPTCHA form.

Of course, there is no guarantee that removing a CAPTCHA will increase conversions by double digits, but eliminating the need for a CAPTCHA challenge can definitely improve the user experience. The question is: How can you eliminate traditional CAPTCHAs without simultaneously exposing yourself to unwanted bot traffic?

How to implement bot protection without showing a CAPTCHA

The answer is a specialized bot protection solution. If humans can be distinguished from bots with sufficient accuracy, CAPTCHAs become obsolete for your real visitors.

Here’s how DataDome does it using a two-tier verification system:

1. When a user loads a page, our real-time machine learning (ML) detection processes technical, statistical, and behavioral signals within milliseconds, blocking bots while letting humans through. This is our invisible verification, known as Device Check, which handles the majority of the verification behind the scenes with zero user friction.
2. Only when identification isn’t conclusive after that initial detection will a user see a CAPTCHA alternative.
3. When step-up verification is needed, we use DataDome Slider, our CAPTCHA alternative—built for security, optimized for user experience and accessibility, and compliant with data privacy regulations globally. No puzzle-solving is required.

That way, just 0.01% of human visitors ever reach the Slider stage.

Why we killed CAPTCHA

For most of its history, CAPTCHA has worked the same way everywhere: show every visitor a puzzle, and let solving it stand in for proof of humanity. But now, about half of the traffic that successfully solves a CAPTCHA today is a bot, not a person.

In early 2026, DataDome retired the standalone CAPTCHA and replaced it with the Slider—not a harder puzzle, but a different question. Instead of asking “can this visitor solve a puzzle?”, DataDome asks “does this request, this device, and this interaction look like a genuine human session?”

That shift changes what a completed challenge actually means. A traditional CAPTCHA is a gate: pass it once, and you’re through. The Slider is a feedback layer: completing it contributes one more signal to DataDome’s detection engine, which keeps evaluating the session afterward rather than treating a solve as final proof. A human-assisted bot or a CAPTCHA-farm worker can still complete a simple slide interaction, but the behavioral and device signals collected during that interaction, combined with everything DataDome already knows about the request, are far harder to fake convincingly than a puzzle answer.

The practical result: 99.99% of visitors never see a challenge at all. The few who do get a quick slide, not a 10-15 second image puzzle.

Security doesn’t have to mean friction for real users. Book a demo to learn more about DataDome, or test your website for free today.