User Experience
What is User Experience?
User experience is everything a person encounters while using a product: whether they can complete what they came to do, how long it takes, and how it feels. It is broader than visual design, and it includes the security checks a site puts in the way.
That last part is the reason this term appears in a bot-protection glossary. Every verification step is a tax on the user experience, and it is charged at the worst possible moment — on sign-up, on login, at checkout, where the person is most committed and most likely to give up.
Where security and experience actually conflict
| Check | What it costs the user |
|---|---|
| Image puzzle | 10–30 seconds, often several attempts, and exclusion for some disabled users |
| Checkbox plus risk score | Seconds when it passes, a puzzle when it does not |
| SMS verification code | Context switch to another device, and failure when roaming |
| Email confirmation loop | Leaves the site entirely; a common drop-off point |
| Aggressive rate limiting | A refusal with nothing the user can do about it |
| Invisible check | Nothing |
The pattern is clear enough: the cost is in asking, not in checking. A check that needs no interaction has no experience cost, which is why the whole industry has moved that way.
Accessibility, and the legal exposure
It is the part that produces legal exposure as well as lost customers. A CAPTCHA that cannot be completed by someone using a screen reader is a barrier to a service, and in the UK that engages the Equality Act, in the EU the Accessibility Act, and in the US the ADA — which has produced litigation specifically over inaccessible verification.
Audio alternatives are the standard answer and they are a poor one: unreliable, slow, and frequently harder than the visual puzzle. The better answer is not to require the interaction.
Measuring the cost rather than assuming it
The reason security friction persists is that nobody measures it, because the users it costs you do not complain — they leave. Three things worth instrumenting:
- Completion rate on each protected form, before and after any change to the verification
- Time to complete, which is where a puzzle shows up plainly
- Repeat attempts, the signal that a check is failing legitimate users
Then test the paths manually with a screen reader, with keyboard-only navigation, on a mobile network, and in a privacy-hardened browser. Those four cover most of the populations that unusual-looking-therefore-blocked logic rejects.
The position worth holding
Decide most sessions on evidence already present, and reserve a visible challenge for the ones that genuinely cannot be resolved. That inverts the usual arrangement, in which every visitor pays a puzzle so that a minority can be caught, and it is the design Procaptcha implements.