Key takeaways
- Subscription bombing floods a victim's inbox by signing them up to many sites in a short time.
- It is often used to hide fraud alerts or security emails during an attack.
- Your confirmation and welcome emails become part of the flood, causing complaints against you.
- Warning signs: sudden spikes of signups, many from the same IP ranges, unconfirmed addresses.
- Layer CAPTCHA, rate limiting, double opt-in and verification to stop your form being used.
In this guide
- What subscription bombing is
- Why your business is affected
- How to recognize an attack
- The layered defense
- Forms that are often forgotten
- What to do during and after an attack
- Why double opt-in matters even more here
- A note on transactional emails
- An example timeline of an attack
- Setting up a simple spike alert
- Protecting the victim
- Questions to ask your form or email provider
- In one minute
- Checklist
- Frequently asked questions
What subscription bombing is
Subscription bombing (also called list bombing or email bombing) is an attack in which bots sign up a victim's email address to hundreds or thousands of newsletters, forms and accounts in a short time. The victim's inbox fills with confirmation emails, welcome emails and newsletters from sites they never visited.
The flood is often a cover. While the victim is buried under messages, the attacker uses stolen credentials to make purchases or change account settings, hoping that the real alert from a bank, a shop or a service provider goes unnoticed among the noise.
Why your business is affected
You are not the target, but your signup form is the weapon. That has consequences for you:
- Complaints: the victim, understandably, reports many of these emails as spam, including yours.
- Reputation damage: complaints from an attack count against your sender reputation like any other.
- Bounces: attacks sometimes mix real victims with invalid addresses.
- Polluted data: your list fills with contacts who never wanted your emails.
- Costs: you pay to store and email people who are not your audience.
How to recognize an attack
| Signal | What it looks like |
|---|---|
| Signup spike | Many more signups than usual in minutes or hours, without more traffic or a campaign |
| Same address repeated | One address submitted many times, or several forms filled with it |
| Unusual sources | Many signups from the same IP ranges or from countries outside your market |
| Strange field values | Random names, empty optional fields, identical answers |
| Low confirmation | Double opt-in confirmations far below your normal rate |
| Complaints from new contacts | People who just "subscribed" report your welcome email as spam |
The layered defense
1. CAPTCHA
Attackers rely on automation, so CAPTCHA is the most effective barrier. An invisible or score-based CAPTCHA stops most scripts without bothering real visitors. Make sure it protects every form that triggers an email, not only your main newsletter form.
2. Rate limiting
Limit how many signups you accept from one IP address in a given period, and how often the same email address can be submitted. Even a simple rule, such as one signup per address per day, blocks repeated bombing of the same victim through your form.
3. Double opt-in
With double opt-in, a victim receives only one confirmation email from you, and never your newsletters. That limits your share of the flood. Keep the confirmation email short, plain and clearly transactional, with a line such as: "If you did not request this, you can ignore this email and you will not hear from us again."
4. Honeypot and time checks
Hidden fields and minimum fill times stop simple bots for free. See how to stop fake signups and bots for the code.
5. Real-time verification
Verification does not stop attacks that use real victims' addresses, which are valid. But many bombing scripts mix in invalid and disposable addresses, and real-time verification refuses those. It is one layer, not the whole defense; setup details are in real-time email verification.
Forms that are often forgotten
- Footer newsletter forms on every page
- Lead magnet and download forms
- "Notify me when back in stock" forms
- Account creation and password reset requests
- Contact forms that send an automatic reply
- Old landing pages from past campaigns that are still online
Attackers look for any form that sends an email without protection. Audit all of them, including old pages.
What to do during and after an attack
- Turn on CAPTCHA immediately if it is not active, or switch it to a stricter mode for the affected forms.
- Pause automated welcome sequences for signups in the attack window, if your platform allows it.
- Export signups from the attack window and remove those who did not confirm.
- Suppress the abused addresses so they do not receive further emails, even if they are valid.
- Watch your complaint rate for the following week, and investigate any campaign with unusual complaints.
- Document the incident: date, forms affected, protections added.
Why double opt-in matters even more here
With single opt-in, every bombed address enters your marketing list and receives your whole welcome sequence and newsletters. Victims report all of them. With double opt-in, they receive one email and nothing else. If you prefer single opt-in for most traffic, consider switching to double opt-in automatically when signup volume spikes, or for traffic from unusual sources.
A note on transactional emails
Account creation and password reset emails are also abused in bombing attacks. Apply rate limits to these flows too, and avoid putting marketing content in them, so a victim does not see a promotional message from you among the flood.
An example timeline of an attack
| Time | What happens | What you see |
|---|---|---|
| Night, hour 1 | Bots start submitting the victim's address on many websites | Signup spike on your footer form |
| Hour 2 | Your confirmation or welcome email is sent to the victim | Normal sending logs |
| Morning | The victim finds hundreds of emails and reports many as spam | Complaints from new contacts |
| Days after | Complaints affect your reputation at the victim's provider | Slightly lower inbox placement |
This timeline is illustrative, but it shows why attacks are often noticed only after the damage. Monitoring signup volume per hour, with an alert for unusual spikes, lets you react within the first hour.
Setting up a simple spike alert
- Find your normal hourly signup range over the last month.
- Set an alert in your form tool, email platform or analytics when signups exceed several times that range.
- Prepare an action plan: enable strict CAPTCHA, switch to double opt-in, pause welcome automations.
Many platforms support webhooks or automation triggers that can send you a message when a threshold is crossed. Even a daily review of signup counts catches most attacks before they grow.
Protecting the victim
If you discover that your form was used against someone, suppress their address immediately so they receive nothing more from you. If they contact you, explain that their address was submitted by an automated attack, that it has been removed, and that you have strengthened your form. A respectful answer protects your brand and helps the victim.
Questions to ask your form or email provider
- Does the form support CAPTCHA, and is it enabled on every form?
- Can I limit signups per IP address and per email address?
- Can double opt-in be enabled for some forms or traffic sources only?
- Can I be alerted when signups exceed a threshold?
- Can I pause an automation instantly during an incident?
If your current tools cannot answer yes to most of these, plan to add the missing protections, starting with CAPTCHA and double opt-in.
In one minute
Subscription bombing abuses unprotected forms to flood a victim's inbox, and your emails become part of the flood. Protect every form with CAPTCHA and rate limits, use double opt-in, filter invalid addresses with verification, monitor signup spikes and have a clean-up plan ready.
Checklist
- CAPTCHA on every form that triggers an email
- Rate limits per IP and per email address
- Double opt-in, or automatic switch to double opt-in during spikes
- Honeypot fields and time checks
- Real-time verification to filter invalid and disposable addresses
- Old forms and landing pages audited
- Incident procedure ready: pause, clean, suppress, monitor
Attacks are one source of complaints. To keep complaints low overall, see why emails go to spam and the section on complaints in sender reputation.
Frequently asked questions
Why would someone sign up a stranger to my newsletter?
To flood that person's inbox so they miss an important email, such as a bank or account security alert during fraud.
Am I responsible if my form is abused?
You are not the attacker, but the victim may report your emails as spam, which hurts your reputation. Protecting your form is in your interest.
Does double opt-in stop subscription bombing?
It stops ongoing marketing to the victim, but each confirmation email still lands in the flood. Combine it with CAPTCHA and rate limits.
How do I spot a bombing attack?
Look for unusual signup spikes, signups from the same IPs or countries unrelated to your audience, and many signups that never confirm.
What should I do after an attack?
Remove unconfirmed signups from the spike, add stronger protection, and check complaint rates over the following days.
