Agent Wranglers

AXS-66Required

Never let a puzzle be the only way through

Never make a visual or audio puzzle the only way to sign up, sign in, pay or send a form. Use a check people never see, or offer a second way that uses another sense or no puzzle. This is WCAG criterion 1.1.1 (A).

By Agent Wranglers. Updated .

How to do it

WCAG allows a CAPTCHA only when another form of it uses a different sense, such as sight and hearing. The W3C note on CAPTCHA prefers checks that need no action from people. Examples are a hidden honeypot field, rate limits and a risk score. Audio puzzles fail many people with cognitive disabilities, and logic puzzles fail people with learning disabilities. Show a challenge only when Score every sign-up for risk asks for one. Then offer an email link or a one-time code as well. Sign-in steps also follow Make signing in easy for everyone.

Examples

HTML example

<!-- Honeypot: hidden from people and screen readers, filled in by many bots -->
<div class="hp" aria-hidden="true">
  <label for="website">Website</label>
  <input id="website" name="website" tabindex="-1" autocomplete="off">
</div>

JavaScript example

app.post('/signup', async (req, res) => {
  if (req.body.website) return res.status(400).end();
  if (await riskScore(req) > CHALLENGE_THRESHOLD) return res.render('verify', { ways: ['email-link', 'puzzle'] });
  await createAccount(req.body);
  res.redirect('/welcome');
});

Python example

@app.post("/signup")
def signup(form: SignupForm, request: Request):
    if form.website:
        raise HTTPException(400)
    if risk_score(request) > CHALLENGE_THRESHOLD:
        return render("verify.html", ways=["email-link", "puzzle"])
    create_account(form)
    return RedirectResponse("/welcome", status_code=303)

How to check

A browser test sends each public form with a low risk score and sees no challenge. With the score forced high, the challenge offers at least two ways, one without a puzzle, and each completes by keyboard alone.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/captcha-alternatives">Agent Wranglers accessibility playbook</a>. In code you write, add a comment next to it with the same link.