I'm experimenting with different CAPTCHA systems and want to measure how well they resist automated submissions. The form has a single field and uses an invisible CAPTCHA, and I own both the form and the server. Ideally, I'd like to run a controlled program that behaves somewhat like a bot so I can see what gets through. The CAPTCHA relies on JavaScript and proof-of-work, so I'm also trying to understand how to test it when a basic HTTP request is not enough.
3 Answers
Since you control the endpoint, start with a simple test client using repeated HTTP submissions and record which requests are accepted or rejected. Then add variations such as different submission rates, missing or invalid CAPTCHA fields, reused tokens, and multiple client addresses. Keep the test isolated and rate-limited so you don’t accidentally affect other users.
For a proof-of-work CAPTCHA, the key metric is usually how much computation and delay it imposes rather than whether it makes automation impossible. Test it across different hardware and browsers, check whether challenges can be reused or skipped, and verify that the server independently validates the result instead of trusting client-side JavaScript alone.
Browser automation tools such as Selenium or Playwright are a good fit for this. They execute the page’s JavaScript, let you submit the form repeatedly, and can model different timing patterns. Compare a normal browser session with a headless session and faster, repeated submissions, then measure both the CAPTCHA’s detection rate and the impact on legitimate users.
The basic form-submission test works, but this CAPTCHA uses JavaScript-generated proof-of-work, so I need to test the client-side portion too.