Your waitlist jumps by 400 overnight. Then you notice the names are random letters, half the addresses bounce, and three people write in asking why they got a “confirm your subscription” email from you. Bots found your sign-up form.
This guide is about stopping bot sign-ups on waitlists, registrations, newsletter and trial forms, without making every real person solve a puzzle. For spam on contact and lead forms in general, see how to stop form spam without a CAPTCHA.
Why bots sign up
- Offer abuse. Fake accounts claim a free trial, a first-order discount or a referral reward again and again.
- Subscription bombing. A bot types a victim's address into hundreds of sign-up forms so their inbox drowns in confirmation emails, sometimes to hide a fraud alert. Your form becomes the weapon, and your sending reputation pays for it.
- List poisoning. Junk and trap addresses on your list lead to bounces and spam complaints, and inbox providers start filtering your real emails.
- Random crawling. Most bots don't care what your form is; they submit to every form they find.
Signs of bot sign-ups
- Spikes of sign-ups in a few minutes, often at night or from one country.
- Gibberish names, or names that are URLs.
- Lots of addresses from temporary email services, or the same address with small changes.
- Confirmation emails that bounce, or are never opened or clicked.
- People writing in about emails they never asked for.
6 layers that stop bot sign-ups
1. Invisible bot checks
Four checks people never see stop most scripts: a hidden trap field only bots fill in, a minimum fill time (no human completes a form in under two seconds), a small proof-of-work puzzle the browser solves while people type, and a rate limit per visitor. Keep what they catch as spam rather than showing an error that tells the bot what to change.
2. A code before the sign-up counts
Ask for a one-time code sent to the email or phone before the form can be sent. A bot typing a stranger's address can't read the code, so the sign-up never completes and you never send the victim a stream of confirmation emails. That's stronger than double opt-in, which still sends one email to every address a bot types. Use WhatsApp codes where a phone number matters more than an email.
3. Refuse throwaway emails
Temporary inboxes can receive codes, so refuse their domains outright, with a message asking for a real address. Our guide to blocking disposable email addresses covers how, and what not to block.
4. Block repeat sign-ups
Refuse a second sign-up from the same browser, or with the same email or phone answer. It stops both impatient double-taps and scripts cycling through one form.
5. Firewall rules for odd traffic
If you only serve some countries, block or mark as spam the sign-ups from elsewhere. Rules by IP range, device or referrer cut off one bad source without touching everyone else. Run a new rule in log-only mode first to see what it would catch.
6. Keep spam away from your email tool
Whatever gets flagged shouldn't reach your email platform, CRM or welcome sequence. Make sure spam stays in the form tool and only clean sign-ups flow on to the systems that send email.
| Layer | Stops | Cost to real people |
|---|---|---|
| Invisible bot checks | Generic scripts | None |
| Code before sign-up | Fake and stolen addresses, subscription bombing | Typing a 6-digit code |
| Throwaway email block | Temporary inboxes | None, unless they used one |
| Repeat sign-up block | Double-taps, scripted repeats | None |
| Firewall rules | Traffic from places you don't serve | None, if the rule is right |
| Spam kept out of integrations | Junk on your list | None |
When a challenge is worth it
Some attacks are written for your form in particular. When one gets through, don't put a puzzle in front of everyone. Show a one-click challenge, such as Cloudflare Turnstile, only to the visitors a rule picks out: one country, one IP range, one referrer. Everyone else keeps signing up without it.
Cleaning up your list
- Remove addresses that hard-bounced or came from temporary email services.
- Remove sign-ups that never confirmed, if you use double opt-in.
- Look at the time and country of the spike, and add a firewall rule for that source.
- Check the welcome emails sent during the attack, and apologise to anyone who wrote in.
In Tapzy
- Always on: a hidden trap field, a background proof-of-work puzzle, a 2-second minimum fill time, automation checks and 8 submits a minute per visitor.
- Codes: email, WhatsApp or SMS codes, or Google sign-in, checked on the server before the response is accepted.
- Throwaway emails refused by default, and business-emails-only if you want it.
- Prevent duplicate submissions by Same browser or Same answer.
- Firewall rules to allow, block, mark as spam or challenge with Cloudflare Turnstile, with a log-only mode.
- Spam stays out of your limits, notifications and integrations, so it never reaches your email tool.
Start from the waitlist template or the event RSVP template, or read how Tapzy's spam protection works.