I was tired of seeing the same variety of CAPTCHA systems online that consist mainly of letters and numbers. These have gotten so complex, they are close to impossible for even humans to guess. Since my new site needed a captcha system to stop the comment spam, I decided to write my own captcha just for fun, except instead of letters, using shapes. It's very simple, yet quite effective (no spam comments since I launched, compared to several hundred spam comments with the last wordpress with a conventional captcha system).




The current version uses circles and boxes and prompts the user to enter the count. The shape overlaps and deformations make it pretty hard for a bot to guess (but not impossible). Compared to a using a regular captcha, the biggest strength in rolling your own captcha is that no one would try to create a bot or find a already existing one to break that since the captcha system is rare (such as this one). Security through obscurity in a way. So if you have a big comment spam problem, and have a hour or two to spare, I would highly recommend you create your own captcha variant.

When you are developing your own, make sure to bind the corresponding captcha image to the session, ip, unique key, and what ever else you want and make sure to have a expiration method as well as have a failure threshold to thwart brute force attacks.

My Captcha in Action

Update Dec 4, 2009: I migrated the comment system to Disqus, so this is not available on my site any more. Disqus is taking care of the spam/bot issues for me now on.