CAPTCHAs That Lock Out Blind Visitors

The test at the bottom of the form

A visitor fills in your contact form, reaches the bottom, and is asked to prove they are human: type the wobbly letters, or select every square containing a storefront.

For most people it is a minor irritation. For someone who is blind and uses a screen reader, software that reads the page aloud, a picture puzzle is a wall.

For someone with low vision, magnifying the screen to read it, the puzzle may be impossible to see whole. Either way, the form is never sent.

And the business does not hear about it. A visitor who cannot get past the test cannot use the form to say so.

Who the puzzle stops

• Screen reader users, for whom an image puzzle has no meaning.
• People with low vision who magnify the page to read it.
• People who are deaf and blind, for whom no version works.
• People with dyslexia facing distorted letters.
• Older visitors with unsteady hands and small tiles to tap.
• Anyone on a weak connection waiting for image after image.

The second group is the one most often forgotten. Magnified, a grid of nine photographs shows a few tiles at a time, and finding the storefronts means scrolling around a puzzle that keeps changing.

The audio alternative only goes so far

Most CAPTCHA services offer an audio version: spoken numbers or words, usually over background noise added to defeat software.

The noise that defeats software also defeats many people, especially older listeners and anyone hearing a second language.

Audio challenges are sometimes refused to visitors whose traffic looks unusual, and a visitor who is deaf and blind can use neither version.

An alternative that works for some people some of the time is not the same as a form everyone can send.

What the accessibility standard says

WCAG 2.0, the accessibility standard most rules in Canada and elsewhere refer to, addresses CAPTCHAs directly.

It accepts that a test of whether the visitor is human cannot have a full text equivalent.

Instead, it asks for a description of the test's purpose and for versions using different senses, so that no single disability rules a person out.

A puzzle with no audio option fails that. A form with no puzzle at all does not need to meet it.

Why the CAPTCHA was added

Nobody puts a puzzle on a form out of malice. It usually arrives after a bad week of spam: dozens of messages a day offering pills, loans and search rankings.

The CAPTCHA stopped them, and that was visible. What it also stopped was invisible: real people who could not complete it, and others who gave up rather than squint.

So the question is not whether to stop spam. It is how to stop it without also stopping customers.

A worked example

A home support agency arranges in-home care for older people: help with meals, medication reminders and getting about. Many enquiries come from adult children, and some from older people themselves.

Its contact form ended with a distorted-text CAPTCHA, added years earlier after a wave of spam, with no audio option.

The agency learned what it was costing when a woman phoned to say her father, who has macular degeneration, had tried for days to send the form with his screen magnified, and given up.

The CAPTCHA came out. In its place went a hidden honeypot field, a check on how quickly the form was submitted, and a server filter that sends doubtful messages to a review folder instead of deleting them.

Spam settled at a few messages a week, caught by the filter, and the form became one that anybody who could reach it could send.

Honeypot fields

A honeypot is an extra field, invisible to people, that spam programs fill in because they fill in everything. A submission with that field completed is discarded.

It asks nothing of the visitor, but it needs care. The field must be hidden from screen readers as well as from sight, and kept out of the browser's autofill, or a real person's message may be thrown away.

Done properly, it stops much of the simplest spam on its own.

Checks on the server

The server receiving the form can apply several quiet tests. A form submitted two seconds after the page loaded was not typed by a person.

Messages full of links, or with a link in the name field, are almost always spam. So are bursts of near-identical messages from one address within a few minutes, which the server can simply limit.

For heavier spam, filtering services compare each message with patterns seen across many other sites, the same approach many WordPress sites already use for blog comments.

Invisible checks

Google's reCAPTCHA, the most widely used service, is best known for its I'm not a robot checkbox, which passes many people straight through and sends others to the image grid.

Its invisible version goes further. It watches how the visitor uses the page and only shows a puzzle to visitors it considers suspicious, so most never see a challenge.

Those who do still meet the same grid, so the audio alternative must remain. And because the check sends information about visitors to Google, it belongs in your privacy policy.

Quarantine, do not delete

Whatever the method, send doubtful messages to a folder somebody checks weekly rather than deleting them on arrival.

No filter is perfect. A real enquiry caught by mistake and found two days later is a slow reply; one deleted on arrival is a customer who thinks you ignored them.

The counter-case

Some forms face heavier pressure than a contact form.

Account sign-ups, logins and anything bots can profit from, such as ticket sales or limited offers, may need stronger checks, and sometimes a challenge is the right tool.

Even then, the invisible version with a working audio alternative beats a puzzle for every visitor, and a phone number and email address beside the form give anyone who is stuck another way through.

For an ordinary contact or quote form, start with the gentle methods and add a challenge only if they fail.

What to do

1. Try your own form with a screen reader.
2. Remove any visible puzzle without an audio option.
3. Add a properly hidden honeypot field.
4. Add server checks for timing and links.
5. Send doubtful messages to a review folder.
6. Show a phone number and email beside the form.
7. Mention any third-party check in your privacy policy.

Step one takes ten minutes and settles the argument. Every iPhone has a screen reader called VoiceOver built in: turn it on, close your eyes, and try to send your own form.

Another barrier that only appears when you stop using a mouse is covered in the outline your designer removed.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.