← All checks
Captcha on forms: can an agent complete a conversion?
Group D4 pointsrubric r1
We load the homepage, up to two key pages and the contact page, find the pages with a form, and check whether those pages load a captcha script.
Why it matters
Captchas exist to stop automated clients, so they stop an agent acting for a real user too. If the sign-up, contact or checkout form needs one, the agent has to hand the task back to the person. All forms with a captcha score 0, some score 2, none score 4. Pages with no form at all get 2.
How to fix it
- Replace visible captchas with server-side checks such as honeypot fields and rate limits.
- If you keep a challenge, use an invisible or risk-based one that does not block clients with an API key.
- Offer an API or an email address as an alternative to the form.
- Remove
g-recaptcha,hcaptchaorcf-turnstilewidgets from forms that do not need them.
How to verify
Run curl -s https://example.com/contact | grep -iE "recaptcha|hcaptcha|turnstile" and expect no output.