Removing CAPTCHA is harmful for my forms?

Question

I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is it harmful for my site?

Answer 1

Yes and no. While people find captchas annoying, not having one couuld lead to automated bots creating accounts. If your site allows interaction, i.e. commenting, the bots may create accounts and spam links/adverts everywhere.

So if your site requires interaction, or a user can submit data that is published on the site, I would recommend keeping the captcha.

Answer 2

Security and usability are always going to be at odds. The more secure you make something the harder it typically becomes to use.

If you want to keep spammers from abusing your registration form you can use these tips I gave in a previous answer:

1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

2) Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

3) Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

4) Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

5) Use Askimet. It is great at identifying spam.

Answer 3

The point of CAPTCHA is to prevent bots (or non-humans) from submitting your form. That captcha is not likely what's keeping your users away (though if it is too hard then it might be a problem). You can remove your captcha, but make sure to have some other anti-bot measures.

Answer 4

There is a always a balance between security and user-friendliness.

In this case the latter appears to be suffering from the former, but only if the decrease in registrations is a decrease in actual registrations, and not just because you formerly had many automated bot registrations.

You can try removing the CAPTCHA and see if registrations go up again, but you'll need to monitor how many of them are real.