---
title: "Never let a puzzle be the only way through · Agent Wranglers"
url: https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/captcha-alternatives
id: AXS-66
level: Required
risk: law
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1044
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Never let a puzzle be the only way through

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Forms, changes and time](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AXS-66
- Level: Required
- Chapter: [Forms, changes and time](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time.md)
- Rule: Never make a visual or audio puzzle the only way to sign up, sign in, pay or send a form. Use a check people never see, or offer a second way that uses another sense or no puzzle. This is WCAG criterion 1.1.1 (A).
- Check: A browser test sends each public form with a low risk score and sees no challenge. With the score forced high, the challenge offers at least two ways, one without a puzzle, and each completes by keyboard alone.
- Risk: A law broken
- How: WCAG allows a CAPTCHA only when another form of it uses a different sense, such as sight and hearing. The W3C note on CAPTCHA prefers checks that need no action from people. Examples are a hidden honeypot field, rate limits and a risk score. Audio puzzles fail many people with cognitive disabilities, and logic puzzles fail people with learning disabilities. Show a challenge only when [Score every sign-up for risk](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/sign-up-risk-score.md) asks for one. Then offer an email link or a one-time code as well. Sign-in steps also follow [Make signing in easy for everyone](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/accessible-authentication.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### HTML example

```html
<!-- Honeypot: hidden from people and screen readers, filled in by many bots -->
<div class="hp" aria-hidden="true">
  <label for="website">Website</label>
  <input id="website" name="website" tabindex="-1" autocomplete="off">
</div>
```

### JavaScript example

```js
app.post('/signup', async (req, res) => {
  if (req.body.website) return res.status(400).end();
  if (await riskScore(req) > CHALLENGE_THRESHOLD) return res.render('verify', { ways: ['email-link', 'puzzle'] });
  await createAccount(req.body);
  res.redirect('/welcome');
});
```

### Python example

```python
@app.post("/signup")
def signup(form: SignupForm, request: Request):
    if form.website:
        raise HTTPException(400)
    if risk_score(request) > CHALLENGE_THRESHOLD:
        return render("verify.html", ways=["email-link", "puzzle"])
    create_account(form)
    return RedirectResponse("/welcome", status_code=303)
```

## Sources

- [WCAG 2.2 – 1.1.1 Non-text Content](https://www.w3.org/TR/WCAG22/#non-text-content)
- [W3C – Inaccessibility of CAPTCHA](https://www.w3.org/TR/turingtest/)

## Related rules

- TNS-11 [Score every sign-up for risk](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/sign-up-risk-score.md) in Trust and safety
- AXS-31 [Make signing in easy for everyone](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/accessible-authentication.md) in Accessibility

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/captcha-alternatives">Agent Wranglers accessibility playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Make signing in easy for everyone](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/accessible-authentication.md)
- Next: [Never ask for the same thing twice](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/redundant-entry.md)
- [Forms, changes and time](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time.md)