[paulgb]

It depends on the threat. If you're worried about someone writing a custom script to attack your site, you want a hard captcha. If you're worried about random form-filling bot spammers, you want to be unique.

I wrote a plugin for wordpress years ago that simply asked you to copy a number into a box. If you had JavaScript, it would even do it for you and hide it so most users never even knew it was there. It filtered out nearly every single piece of spam. This would have been mid-2000s though, might be different now.