This lesson's interactive features are locked, please to keep using them

CAPTCHA

A CAPTCHA is an anti-automation challenge for requests that are suspicious but not risky enough to block outright.

A CAPTCHA can reduce automated abuse of a form, but it does not absorb a DoS flood. The request still reaches your infrastructure before the challenge is evaluated.

You've certainly seen CAPTCHAs before:

CAPTCHA Data Flow

Here's how the challenge -> token -> verification flow works:

Server-side verification is mandatory (though a CDN or reverse proxy may handle it for you). If you skip this step, the CAPTCHA provides no protection at all – an attacker just omits the token and sends the request directly.