CAPTCHA fatigue, and what users actually do

You built a form because you want people to use it. Then, somewhere along the way, you put a puzzle in front of it - a toll booth on a road you paved specifically to bring people to your door. Every visitor now pays a small tax of time and attention before they are permitted to say hello.

That trade can be worth it. Sometimes it clearly is. But the tax is real, it is measurable, and it is paid exclusively by the people you wanted to hear from - which makes it worth accounting for honestly rather than treating the challenge widget as a free checkbox. This essay tries to do that accounting: what challenges cost, what users actually do when they meet one, how the invisible generation changed the terms, and when the toll booth genuinely earns its keep.

The numbers here are unusually well studied. A large-scale Stanford evaluation in 2010 - Bursztein et al., "How Good Are Humans at Solving CAPTCHAs?" - measured humans taking roughly ten seconds on average for text challenges and close to half a minute for audio ones, with far-from-perfect success rates and notably poor agreement on audio.

A 2023 empirical study presented at USENIX Security (Searles et al.) reran the question against modern challenge types and found solving times in a similar nine-to-fifteen-plus second range depending on type, with human accuracy well short of 100 percent. Seconds of friction and a real failure rate, applied to every single legitimate visitor: that is the baseline cost before a single spam message is prevented.

Faced with a challenge, users split into predictable groups. Some solve it and move on, mildly taxed. Some fail - blurry crosswalks, ambiguous storefronts - and retry, each loop compounding irritation. Users who rely on audio challenges inherit the slowest, most error-prone path of all, a burden the W3C documents in its note on the inaccessibility of CAPTCHA. And some simply leave.

The leavers are the group to worry about, because they are invisible. An abandoned challenge produces no submission, no error, no log entry - nothing to count. Published abandonment figures vary too widely by audience and challenge type to quote one honestly, but the direction is consistent across every study we have read: some nonzero slice of real visitors meets the puzzle and walks. You will never learn which ones.

The same 2023 study documented the uncomfortable punchline: automated solvers now beat humans at most challenge types, solving faster and with higher accuracy than the people the puzzles were built to admit. And where automation falls short, commercial solving services - real humans and models farming solves in bulk for trivially small fees - close the gap for any attacker with a budget.

Sit with that inversion for a moment. A visual puzzle at the gate now filters for determined machines and against hurried, distracted, or disabled humans. The classic image-grid CAPTCHA has quietly become a tax whose incidence falls mostly on the honest. This is not an argument that all gating is obsolete - it is the reason the industry moved the gate somewhere else.

The current generation - Cloudflare Turnstile, reCAPTCHA v3, and kin - mostly stopped asking humans to prove anything. They observe browser and interaction signals, run lightweight checks behind the scenes, and pass the overwhelming majority of visitors without showing a puzzle at all, escalating to an interactive check only when signals look bad.

This is a genuinely better deal, and it deserves to be called that. The median visitor pays close to nothing, the naive bot still fails, and the puzzle - when it appears - is reserved for the suspicious tail rather than levied on everyone. When we argue against challenge-first design elsewhere, we are not arguing against this generation's existence; we are arguing about where it belongs in the stack. More on the Turnstile glossary page.

Close to nothing is not nothing. Invisible challenges require JavaScript, so users with scripts disabled cannot submit at all. They score on browser signals, which means privacy-hardened browsers, VPN users, and unusual configurations get low scores through no fault of their own - and either face the interactive fallback or fail silently, joining the invisible leavers. The false positives did not disappear; they moved to the visitors least likely to complain.

There is also an architectural cost: a third-party dependency sitting directly in your conversion path, adding a network round-trip and a script from someone else's infrastructure to every page with a form - the same caution that applies to any external dependency discussed in our CORS guide. None of this is disqualifying. All of it belongs on the invoice.

Being fair to CAPTCHAs means naming the cases where they win. A sustained, targeted campaign that runs headless browsers defeats the honeypot and mimics human timing; passive signals thin such traffic but cannot end it, and a challenge at the gate can. Human spam farms pass every mechanical check by definition - although, honestly, they beat challenges too, at a price; the challenge at least imposes that price.

Forms gating expensive actions deserve gates: signups that provision resources, coupon or trial generators, anything where each fraudulent submission costs real money rather than a moment of attention. And a review queue drowning in hundreds of daily junk items is itself a signal that volume, not judgment, is the problem - the case where quarantine alone is the wrong tool and a challenge upstream is the fix.

The position we keep arriving at: run the free, frictionless layers first - honeypot, timing signal, rate limits, content heuristics - with quarantine catching the uncertain remainder. For most forms, most of the time, that stack handles the problem with zero user-facing friction. Turn the challenge on when evidence says the passive layers are losing: a queue full of headless-browser traffic, a campaign that will not break.

And turn it off when the campaign passes. A challenge is medication, not diet - the right response to an acute condition, a poor thing to live on permanently. The complete version of this argument, including where quarantine itself falls short, is in quarantine vs CAPTCHA.

Zoom out from any single form and the fatigue framing gets clearer. Your visitors solve challenges all day, everywhere - logging in, checking out, reading articles. Each one spends a little of a finite budget of patience, and by the time someone reaches your contact form they have been proving their humanity to strangers since breakfast.

A contact form is very often the first interaction a prospect has with you, and a puzzle is a strange greeting. The businesses that feel this most are the ones running paid traffic to landing pages - having paid per click to bring a visitor in, every increment of friction between click and submitted lead has a price on it. Attention spent on your challenge is attention your form's actual questions do not get.

SheetLink Forms ships the passive stack on by default and treats the challenge as an option, not a default: Cloudflare Turnstile is built in and can be enabled per form when a situation calls for the gate, then disabled when it passes. Suspicious traffic in between lands in quarantine for one-click review rather than being silently discarded - the design argument this whole series keeps returning to.

The honest summary: challenges are a real tool with a real cost, invisible challenges lowered that cost without eliminating it, and the right amount of challenge for most forms, most of the time, is none - with a working escalation path for the weeks when that stops being true. See how it works for the full pipeline, try the live demo - no puzzle in front of it - or check the docs for the per-form settings.

What is CAPTCHA fatigue?

Does Turnstile ever show users a puzzle?

Do CAPTCHAs stop human spam farms?

Will removing a CAPTCHA increase my form conversions?

Are CAPTCHAs an accessibility problem?

When should I actually turn a challenge on?

How do I enable Turnstile on a SheetLink form?

If I use Turnstile, do I still need quarantine?