Key takeaways
- Bot signups come from spam scripts, form abuse and attacks using real people's addresses.
- A honeypot field is invisible to humans and catches simple bots for free.
- Invisible or low-friction CAPTCHA stops more advanced bots with little user impact.
- Real-time verification blocks invalid and disposable addresses that bots often use.
- Double opt-in is the final safety net: unconfirmed signups never receive marketing.
In this guide
- Why bots sign up to your forms
- Signs your forms are under attack
- The protection layers compared
- Layer 1: The honeypot field
- Layer 2: Time checks
- Layer 3: CAPTCHA, preferably invisible
- Layer 4: Rate limiting
- Layer 5: Real-time email verification
- Layer 6: Double opt-in
- Cleaning up after an attack
- Recommended setup by form type
- Signs that it is not bots, but something else
- Bot protection for popular platforms
- The cost of doing nothing
- Keeping protection accessible
- Reviewing protection over time
- In one minute
- Related guides
- Checklist
- Frequently asked questions
Why bots sign up to your forms
Fake signups are not random. They usually come from one of these sources:
- Spam bots that fill every form they find, hoping to post links or test vulnerabilities.
- Subscription bombing attacks that sign up a victim's real address on many sites at once to flood their inbox; see subscription bombing.
- Fraud on free trials, coupons and referral programs.
- Competitors or pranksters submitting junk, more rarely.
The result is the same: invalid and disposable addresses, real addresses of people who never asked for your emails, bounces, complaints and polluted data.
Signs your forms are under attack
- A sudden spike in signups at unusual hours, without a matching traffic increase.
- Names or fields filled with random characters, or the same text in every field.
- Many signups from the same IP ranges, or from countries unrelated to your audience.
- Very low confirmation rates if you use double opt-in.
- Rising bounces on welcome emails and complaints from people who "never signed up".
The protection layers compared
| Layer | What it stops | Friction for real users | Effort |
|---|---|---|---|
| Honeypot field | Simple bots | None | Low |
| Time check (minimum fill time) | Bots that submit instantly | None | Low |
| Invisible / score-based CAPTCHA | Most automated bots | Very low | Low to medium |
| Visible CAPTCHA challenge | Advanced bots | Noticeable | Low |
| Rate limiting | Bursts from the same source | None | Medium |
| Real-time email verification | Invalid and disposable addresses | None for valid addresses | Low |
| Double opt-in | Marketing to unconfirmed addresses | One extra click | Low |
No single layer is enough. Combining several gives strong protection with almost no friction for real people.
Layer 1: The honeypot field
A honeypot is an extra field hidden from humans with CSS. Real visitors never see it, so they leave it empty. Simple bots fill every field, including the hidden one. Any submission with the honeypot filled is rejected silently.
<div style="position:absolute;left:-9999px" aria-hidden="true">
<label for="website">Leave this field empty</label>
<input type="text" id="website" name="website" tabindex="-1" autocomplete="off">
</div>On the server, reject the submission if website is not empty. Use a field name that looks natural to bots, add tabindex="-1" so keyboard users do not land in it, and aria-hidden so screen readers skip it.
Layer 2: Time checks
Humans need a few seconds to type an email address. Many bots submit in under a second. Record the time the form was loaded (in a hidden field or server session) and reject submissions that arrive impossibly fast.
Layer 3: CAPTCHA, preferably invisible
Modern CAPTCHA services can run in the background and score how human a visitor looks, only showing a challenge when something is suspicious. Visible puzzles stop bots but also cost you real signups, especially on mobile. Start with an invisible or score-based option and add visible challenges only if attacks continue.
Layer 4: Rate limiting
Limit the number of signups accepted from the same IP address, or for the same email address, within a short period. This blocks bursts and makes subscription bombing through your form much harder. Many form tools and web application firewalls offer this as a setting.
Layer 5: Real-time email verification
Bots often use invalid, random or disposable addresses. Real-time verification refuses them before they are saved, and before you send any confirmation email that would bounce. Setup details are in real-time email verification for signup forms, and disposable domains are covered in disposable email addresses.
Layer 6: Double opt-in
With double opt-in, an address only joins your marketing list after its owner clicks a confirmation link. Bots and attacked addresses do not confirm, so they never receive your newsletters. It is the final safety net. The confirmation email itself still goes out, which is why the layers above matter: they reduce how many confirmation emails reach the wrong people.
Cleaning up after an attack
- Identify the attack window: the date and time range of the spike.
- Export signups from that window with IP, source and confirmation status if available.
- Remove unconfirmed signups from the window. Verify the rest.
- Suppress invalid, disposable and suspicious addresses so they cannot return.
- Add the missing protection layers to the form that was abused.
- Watch complaints over the next days; people who were signed up without consent may report your emails.
Recommended setup by form type
| Form | Recommended layers |
|---|---|
| Newsletter signup | Honeypot, invisible CAPTCHA, real-time verification, double opt-in for risky traffic |
| Lead magnet download | Honeypot, real-time verification (block disposable), rate limiting |
| Free trial / account creation | CAPTCHA, verification, rate limiting, email confirmation |
| Giveaway entry | All layers, including double opt-in |
| Contact form | Honeypot, invisible CAPTCHA, time check |
Signs that it is not bots, but something else
Not every strange signup is a bot. Before adding friction, check these alternatives:
- A viral post or partner mention can create a real spike from new countries.
- Security scanners at companies sometimes follow links in emails, including confirmation links.
- A broken form that submits twice or saves test values.
- Internal testing by your team or agency on the live form.
Look at traffic sources and timing. Real spikes come with real visits; bot spikes often arrive without matching page views.
Bot protection for popular platforms
| Platform | What to check |
|---|---|
| WordPress form plugins | Built-in honeypot and CAPTCHA options, plus email verification plugins |
| Email platform forms | CAPTCHA setting and double opt-in option in the form builder |
| Shop checkouts | Platform fraud settings and rate limits on account creation |
| Custom forms | Server-side honeypot, time check, rate limiting and API verification |
The cost of doing nothing
Bot signups seem harmless at first: a few junk rows in a database. The problems appear later: bounces on welcome emails, complaints from people who were signed up without consent, inflated contact counts that raise your email platform bill, and engagement rates that fall for no visible reason. Protecting forms early is much cheaper than cleaning and repairing reputation afterwards.
Keeping protection accessible
Bot protection must not lock out people with disabilities. Prefer invisible CAPTCHA over visual puzzles, make sure honeypot fields are hidden from screen readers with aria-hidden and excluded from keyboard navigation, and always provide clear error messages. Test your form with keyboard-only navigation after adding protection.
Reviewing protection over time
Attackers adapt. Every few months, check your signup data for signs of abuse: unusual spikes, low confirmation rates, odd names. If simple bots return, a honeypot may have been recognized; change its field name. If more advanced bots get through, raise your CAPTCHA sensitivity or add rate limits. Protection works best as a routine, not as a one-time setup.
In one minute
Combine invisible layers first (honeypot, time check, invisible CAPTCHA, rate limits), filter bad addresses with real-time verification, and use double opt-in as the final safety net for risky sources. This stops most bots while real visitors notice nothing, and it keeps your list, your costs and your reputation clean.
Related guides
Bots often leave behind toxic addresses and inflate your bounce rate. Clean up regularly after strengthening your forms.
Checklist
- Honeypot field and time check on every form
- Invisible CAPTCHA enabled
- Rate limiting by IP and by address
- Real-time verification blocking invalid and disposable addresses
- Double opt-in on high-risk sources
- Signup spikes monitored, with a clean-up procedure ready
Bots are one source of toxic addresses; cleaning them out regularly is part of a healthy list.
Frequently asked questions
What is a honeypot field?
A form field hidden from humans with CSS. People do not fill it; simple bots do. Any submission with that field filled is rejected.
Do CAPTCHAs reduce signups?
Visible puzzles can. Invisible or score-based CAPTCHAs have little impact on real users and are usually a good compromise.
Why do bots sign up with real email addresses?
Sometimes to attack the owner of the address by flooding their inbox (subscription bombing), or to test forms before abuse.
How do I clean bot signups already in my list?
Filter by signup date and source around the spike, verify those addresses, and remove unconfirmed or suspicious entries.
Is double opt-in enough on its own?
It prevents bots from receiving your marketing, but confirmation emails to fake or attacked addresses still create bounces and complaints. Combine it with bot protection.
