An accessible CAPTCHA is one that a person can complete regardless of vision, hearing, motor control or cognitive difference, and regardless of whether they use a screen reader, keyboard-only navigation or a switch device. In practice that means the primary path cannot depend on identifying images or transcribing audio. The most accessible design is one where the check is invisible for most users and where any escalation is solved by the browser rather than the person.
Accessible CAPTCHA: verification that does not lock people out
Most people never see a challenge at all. When one is needed, the first escalation is proof of work, which the browser solves on its own with no human interaction, so it is passable by everyone regardless of vision, motor control or assistive technology. Image challenges can be switched off per site. Nobody should have to identify a traffic light to buy a ticket.
How the escalation ladder works
Each step only happens if the previous one did not resolve the request. Most traffic stops at step one.
Invisible
Behavioural signals, device characteristics and network reputation score the request. The overwhelming majority of legitimate visitors are resolved here and never see anything.
Proof of work
If the signals are inconclusive, the browser performs a computational challenge on its own. No interaction, no visual task, no time pressure. It is the accessible escalation, and the default one.
Puzzle
For traffic the detectors already consider likely automated. Sites that disable image challenges route here instead, and the difficulty scales with how suspicious the request is.
Image, if you leave it on
Reserved for traffic the detectors already classify as automated. It can be switched off entirely per site from the portal, the recommended setting for any site with an accessibility obligation.
Why Prosopo
Why CAPTCHA accessibility keeps failing
Most users see nothing
Verification is invisible-first. Behavioural, network and device signals resolve the majority of legitimate traffic without any challenge being shown. No other accessibility feature helps everybody at once.
Proof of work needs no human input
The first escalation is a computational challenge the browser solves by itself. There is nothing to see, click, hear or type. A screen reader user, a switch-access user and a sighted mouse user all pass it identically because none of them do anything.
Image challenges can be turned off
Image selection is the least accessible challenge type ever put in front of users. Sites can disable it entirely from the portal, which pushes that traffic onto the puzzle instead. The setting is per site, not a support request.
Keyboard and screen reader support
The widget is operable by keyboard alone and exposes state to assistive technology. No mouse-only interaction, no focus traps, no unlabelled controls.
No audio fallback dependency
Audio CAPTCHA is the traditional accessibility escape hatch and it is the mode solver services defeat most cheaply, so it degrades for the people who rely on it. Building the primary path to be accessible removes the need for a weaker parallel one.
GDPR-compliant and accessible together
Accessibility and privacy usually trade off, because the accessible fallback needs more data or a third-party service. Procaptcha is EU-processed with no cross-site tracking, so meeting one obligation does not cost you the other.
The problem with CAPTCHA accessibility
Every accessibility conversation about CAPTCHA runs into the same wall. The challenge exists to be hard for machines, and the ways of being hard for a machine have historically been the ways of being hard for a person who cannot see the image, cannot hear the audio, or cannot complete a drag inside a time limit.
The industry's answer has usually been a parallel path. An audio alternative, or a registration scheme where a disabled user signs up with the CAPTCHA vendor in advance to receive an accommodation cookie. Both work in the narrow sense. Both also mean the disabled user's experience of your website is worse than everybody else's, and that they had to do paperwork with a third party to get there.
A different order of operations
The accessibility question is settled before challenge design, by how often a challenge happens at all.
Most legitimate traffic never needs one. Behavioural signals, device characteristics and network reputation resolve it. That describes the invisible CAPTCHA mode, and it is the largest accessibility win available because it applies to everyone without anyone opting in.
When something does need escalating, the first escalation is proof of work. The browser does a small amount of computation and submits the result. The user does nothing. There is no image, no audio, no drag, no timer. It is the one challenge type with no accessibility failure mode, because there is no user task to fail at.
Image challenges come last, reserved for traffic the detectors have already classified as automated, and since August 2026 a site can turn them off completely from the portal. Disabling images routes that traffic to the puzzle instead. If you have an accessibility obligation, that is the setting to change on day one.
Where the conformance work stands
A formal WCAG 2.2 AA conformance statement and VPAT are on the roadmap. The product is already built to support them: the widget is keyboard operable and exposes state to assistive technology, and neither the default path nor the first escalation requires a visual or audio task.
If your procurement needs a signed conformance document by a particular date, tell us the date and we will confirm whether we can meet it.
Where this matters most
Ticketing and e-commerce, because the European Accessibility Act covers those journeys and because a checkout is exactly where a failed challenge turns into a lost customer who has no way to complain to you.
Public sector and education, where accessibility obligations are usually stricter and older than the commercial ones.
And any site whose support inbox already contains messages from people who could not get past the CAPTCHA. Those messages are the most direct evidence of an accessibility problem available to you.
Related reading
By the numbers
Trusted by companies of all sizes.
Active websites
0+
Monthly verifications
0+
Bots stopped per month
0+
Reviews
Our customers love us.
Hundreds of businesses have made the switch from reCAPTCHA and hCaptcha to Prosopo. Here's what they have to say.
Frequently Asked Questions
What is an accessible CAPTCHA?
Are CAPTCHAs a WCAG problem?
Yes. Image-selection CAPTCHAs conflict with WCAG success criteria on non-text content and on input modality, and the W3C has published guidance describing the accessibility problems with visual and audio CAPTCHA and recommending non-interactive alternatives. Any challenge requiring a person to interpret an image is an access barrier for blind and low-vision users, and timed challenges are a barrier for users with motor or cognitive differences.
Is reCAPTCHA accessible?
reCAPTCHA offers an audio alternative to its image challenges and Google publishes its dashboards in a very large number of languages, which Forrester credits it for. The underlying problem remains: when reCAPTCHA escalates, it escalates to a task the user has to perform, and the audio alternative is both harder to use and the mode most easily defeated by solver services. Our comparison of the options is on the reCAPTCHA Enterprise page.
Is hCaptcha accessible?
hCaptcha operates a separate accessibility programme requiring users to register in advance for a cookie that reduces challenges. That approach works, but it puts the burden on the disabled user to sign up for an accommodation with a vendor they have never heard of before they can use your website. The stronger design is one where the default path works for everyone.
How does proof of work help accessibility?
A proof-of-work challenge is solved by the visitor's CPU, not by the visitor. There is no image to interpret, no audio to transcribe, no drag to perform and no time limit to beat. Everyone passes it the same way: by waiting a fraction of a second. It is the only common challenge type that has no accessibility failure mode, and it is why we use it as the first escalation rather than an image.
Does Prosopo have a WCAG conformance statement or VPAT?
A formal WCAG 2.2 AA conformance statement and VPAT are on our roadmap. The product is already built so that neither the default path nor the first escalation requires a visual or audio task, and the widget supports keyboard operation and exposes state to assistive technology. If you need a signed conformance document by a particular date, tell us the date.
Does the European Accessibility Act apply to CAPTCHA?
The European Accessibility Act applies to a defined set of products and services including e-commerce, banking, transport ticketing and e-books. Where it applies, the whole purchase journey has to be accessible, and a CAPTCHA sitting in front of checkout is part of that journey. If you sell tickets or run an online shop in the EU, a CAPTCHA a blind customer cannot pass is a compliance problem as well as a lost sale. Take legal advice on your specific obligation rather than ours.
More from Prosopo
What else can Prosopo protect for you?
No matter the threat, we have a solution to keep your business safe.
Product
Spam Filter: Add-on for Procaptcha and Prosopo Protect
Spam Filter is a Procaptcha add-on that blocks fake signups, throwaway emails and abusive-network traffic during each verification — without you writing any extra integration code.
Learn more
Product
Access Control — the Customer-Authored Layer
Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
Learn more
Product
Accessible CAPTCHA: verification that does not lock people out
An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
Learn moreProduct
Enterprise Bot Protection — the Prosopo Platform
Enterprise bot protection from Prosopo. One detection engine, delivered as a widget (Procaptcha) or at the edge (Prosopo Protect), same dashboard for both. Every block comes with a reason, in plain words, rather than a black-box score.
Learn moreProduct
Invisible CAPTCHA
Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot comes with a reason you can read.
Learn more
Product
Procaptcha: the GDPR-compliant CAPTCHA widget
Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 verifications per month.
Learn more
Product
Prosopo Protect — Site-Wide and API Bot Protection
Site-wide and API bot protection from Prosopo — deploy at the edge (Cloudflare Workers, AWS Lambda@Edge) or as a server-side integration (nginx, Caddy, custom reverse proxies). Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.
Learn moreProduct
Residential proxy detection
How Prosopo detects residential proxies — TCP fingerprint interrogation, IP intelligence, and a self-maintained proxy-vendor catalogue. Available on the Enterprise plan.
Learn more