CAPTCHA And Bot Mitigation

CAPTCHA services add an abuse signal to forms and APIs, but they do not prove identity or replace authorization, rate limiting, fraud checks, or server validation.

Why This Matters

Turnstile, hCaptcha, and reCAPTCHA issue short-lived client tokens that the server must verify with the provider before accepting protected actions.

Working Model

The browser obtains a token for one interaction. PHP sends that token and the server secret to the provider verification endpoint. The application validates success, expected context, expiry, and replay policy before applying its own business controls.

Practical Rules

  • Always verify tokens server-side.
  • Keep provider secrets out of HTML.
  • Bind verification to the protected action where supported.
  • Plan accessible and non-JavaScript fallbacks.
  • Combine CAPTCHA with rate limits and behavior signals.

Failure Modes

  • Trusting a hidden form field.
  • Accepting a token twice.
  • Blocking all privacy tools without recovery.
  • Sending sensitive form data to the CAPTCHA provider.

Verification

  • Test missing, invalid, expired, and replayed tokens.
  • Simulate provider timeout.
  • Review privacy and accessibility.
  • Monitor solve and false-positive rates.

Official References

What You Should Be Able To Do

After this lesson, you should be able to explain why CAPTCHA exists, how popular services differ operationally, and how server verification fits layered abuse prevention, choose a suitable approach for a real PHP project, and verify the result instead of relying on assumptions.

Practice

Practice: Verify A Turnstile Token

Design PHP-side verification for a Turnstile-protected signup.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Send the token and secret to Siteverify over a bounded HTTP client, reject transport or verification failure, validate expected context, consume the token once, then continue normal signup validation.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Compare CAPTCHA Providers

Compare Turnstile, hCaptcha, and reCAPTCHA without choosing by brand alone.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Evaluate privacy, accessibility, regional availability, challenge behavior, pricing, analytics, integration, outage policy, and server-verification semantics.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Design Provider Failure Policy

The CAPTCHA provider is unavailable during login and account creation.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Choose risk-based fail-open or fail-closed behavior per action, retain rate limits, expose a recoverable message, monitor the outage, and avoid one global rule for every endpoint.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.