In this paper, we propose a novel image-based completely automated public turing test to tell computers and humans apart (CAPTCHA) that relies on detecting human faces to provide an additional layer of security in web-based services. Face images were selected from the CMU face database and subjected to different types of distortions at different intensity levels to make the automatic face detection very challenging. An extensive experimental study involving 1,100 individuals was undertaken to determine the efficacy of the proposed approach and evaluate the performance of humans compared to computers. We also used two image quality metrics to objectively study the characteristics of the composite CAPTCHA images. Unlike a text-based CAPTCHA, a major benefit of the proposed image-based face detection CAPTCHA is that it does not have any language barriers. In addition, the proposed CAPTCHA can easily be implemented on handheld devices to provide an additional level of security.