9 Ways to Prevent Fake Signups, Bot Attacks and Spam
How do I stop all the fake signups and spam form submissions on my site? Check out these 9 simple ways to put an end to it in minutes on any platform.
Photo by Ed Hardie on Unsplash
Are you looking for a way to prevent fake signups? God knows you’re not alone!
Spambots are probably the ultimate nuisance on the internet today. They slow down your site, try to steal your data, and may prevent genuine human users from interacting with your website in the best way possible.
The result? Data breaches, fake signups, and a general loss of productivity and revenue. Fortunately, you can combat spam bots and protect your site in many ways.
The 9 ways to prevent fake signups, bot attacks, and spam include:
- CAPTCHA
- Double Opt-In
- Honeypot Fields
- Email List Verification
- Two Factor Verification
- Limit Login Attempts
- Blocking Spam Domains
- Use A Firewall
- Monitoring User Activity
In this article, let’s look at protecting your site from spambots by implementing these nine actions.
1. CAPTCHA
You may have found yourself having to click on some images or click on some boxes to prove that you are a human. In many cases, you may be seeing these things when submitting forms or visiting some pages.
Welcome to the world of CAPTCHA, or reCAPTCHA.
CAPTCHA is a simple test to confirm whether a website visitor is human. This ensures that your website does not waste its resources interacting with bots.
If you are wondering if there are differences between CAPTCHA and reCAPTCHA, yes, there is. It is, however, minor. The main purpose remains the same.
The difference is that CAPTCHA presents you with a series of distorted images of letters or numbers and with a form. You must then look at the images, figure out the numbers and letters, and enter them into the form.
A reCAPTCHA is a more modern invention. Instead of entering numbers, you simply check a box to tell them you are a human. This is simpler and much more user-friendly.
If your website suspects that the visitor may be a bot, it may deny access or not respond to the requests from the bot. This saves your resources, allowing real human visitors to enjoy your website better.
2. Double Opt-In
If you really want to prevent fake signups – use double opt-in.
Ever noticed why after you first sign up for something, you will have to go to your inbox and then click on some links to ‘confirm’ your email?
This is because the website is trying to confirm that the email you entered actually exists. If the email exists, the confirmation email will land in your inbox. You can then log into your email and click the link.
Spambots usually will enter random email addresses. They cannot log into that email and click the email confirmation link.
You can implement double opt-in on most of your autoresponder systems. In fact, many of them actually have double opt-in turned on by default. This means every form you create will come with these features.
This should help ensure all the emails you collect from your forms are emails from actual people. This means you will not collect spam emails, saving your subscription quota.
3. Honeypot Fields
Honeypot fields are another way to ensure that your form only collects information from actual human beings, not bots. A honeypot functions by setting a ‘trap.’ This trap will catch bots but let humans pass.
This is achieved by creating an invisible form field. This means when humans fill out the form, they would not see it, leaving it empty. However, bots will notice the form and try to fill it out.
As a result, your website or autoresponder system can quickly distinguish actual humans from bots. You can then set up rules to add those email addresses to a blocklist.
The process of setting up honeypot fields differs depending on the program you use to create the form.
However, you generally start by creating a regular form field. Then give it a common title, such as ‘website URL’ or ‘phone number.’
After that, you hide the field by making the form size ‘0px’. If you can write CSS codes, you can also add the codes to make the form invisible to humans.
4. Email List Verification
Suppose you have a form on your website and have collected some information from the form. However, you are also worried that there are fake signups from bots within the email list.
How do you detect these fake signups and spring-clean your email list?
There are many email verification tools in the market that you can use. These tools usually start by running your email list through a series of checks.
These checks include domain name verification, syntax validation, and more. These tools will also check your email list against their own list of spam and invalid email domains and addresses.
Once detected, these tools will flag or remove these emails for you. Some of these tools will also help to detect duplicate emails, which helps keep your email list clean.
Once you have verified your email list, you should notice improvements in your email metrics. You should see higher delivery and click-through rates and fewer email bounces.
In the long run, your domain will be safer from being blacklisted. This is because you are not sending out email spam addresses.
5. Two Factor Authentication (2FA)
Sometimes, you may notice that once you log into an account, you then need to check your email or phone for additional codes. You then key the code into your account before you can freely access the dashboard.
This is Two Factor Authentication (2FA) in play.
2FA is a security and protection protocol. It requires a user to provide identification from two sources when logging into a website or system.
Two-factor authentication can be from many sources, but in general, they are from:
- Phone number
- Authenticator app (e.g., Google Authenticator)
- Devices that have logged in with the same login details before
- And more.
Having 2FA provides better security for your account since you may still have additional ‘gates’ to protect your data in the event of a data breach.
Suppose your password was leaked, and hackers and spammers now try to log into your account. These hackers and scammers may not know your phone number. Even if they know, the verification code may be sent to your phone, which only you can see.
This means these hackers and spammers still cannot log into your account.
You can use several libraries to set up your own 2FA system. One is the Google Authenticator. This should work well with PHP codes. If you build your app using Python, check out Django Two-Factor Authentication.
6. Limit Login Attempts
Sometimes, spambots may also try to log into your website using the brute force method. In the brute force method, the spambot repeatedly tries to hard guess the password of your website admin login details.
This is one of the most ‘old-school’ ways of trying to break a website’s security, but it still works. This is because not many actually care or know to limit login attempts.
As a result, these brute-force login bots just try multiple combinations of passwords until they get it right. As they try, they use up the resources of your website, which may slow down its performance.
Actual human users may notice that your website becomes slower and have a less enjoyable time surfing. You may even lose some genuine leads and sales this way.
Fortunately, you can easily prevent this from happening if you limit login attempts.
Depending on the system you use to build your website, you can set up login attempt limiters differently. For WordPress websites, you usually only need to install login limiter plugins.
These plugins will allow login attempts several times before locking the IP address out for some time before allowing it to try again.
Some may allow up to a higher number of attempts, but once these are exhausted, the IP address is added to the blacklist. This means the IP address can no longer access the login page.
7. Set Up a Blocklist Of Spam Domains
Another way to block these bots would be to be proactive and set up a blocking list. A blocking list ensures that signups using the blocked domain name will be disregarded.
You can create a blocklist of spam email domains in your autoresponder system. This usually requires you to set up rules. The process of setting these rules may differ depending on your system.
Suppose a spam bot tries to sign up for your form using the email from the blacklisted domain in the autoresponder system. In this case, your autoresponder will move the contact into your blocklist.
You can then come in periodically to clear the blocklist and free up space.
8. Set Up IP Address Blocking System
Aside from setting up blocklists based on domain, you can also set up IP-based protection systems for your website.
These systems usually work by monitoring all the traffic on your site, incoming or outgoing. These systems then check their instructions and rules and apply them to the traffic.
For example, suppose you have an instruction that an IP address cannot refresh a webpage more than 3 times in 5 seconds.
When someone tries to do this, your system triggers a reCAPTCHA to confirm if the traffic is from a human. If there is no response from the reCAPTCHA, your system assumes that it is spambot traffic and adds the IP address to a blocklist.
The most popular option is a Content Delivery Network (CDN). Many CDNs, such as Cloudflare perform these protection tasks for free too. You just need to sign up for an account and connect it to your website.
If you code your website using PHP or Ruby on Rails, you can manually block specific IP addresses in the code itself. This could be done by writing custom code, which means this option may not be for common folks.
9. Monitoring User Activity
Suppose you have set up all the systems discussed here. In this case, your site should be quite safe from spam bots or fake signups.
However, it is still a good idea to monitor your website traffic occasionally. This is because there may be times when your protection may fail to perform. Your website may be targeted for a Distributed-Denial-Of-Service (DDOS) attack if you are unlucky enough.
You can monitor user activity by looking at your traffic, and many website owners would use Google Analytics. When monitoring, they focus on two main metrics: direct traffic and bounce.
One way to tell if you may have issues with spam traffic is that your site has many direct visitors, yet they only view a page and then goes away (bounce). If you notice this with your site, buffing up your protection against spam bots is time.
Key Takeaways
We reviewed nine ways to protect your site from spam bots and fake signups.
Some are related to protecting against spam traffic, such as IP address blocking systems and login limiters. For email, we suggest you do at least the basics, such as setting up honeypot fields and verifying the emails.
Spambots can be a form of cyber attack, meaning you want to protect yourself from it. Luckily keeping them at bay is not difficult and should be doable even by non-techies.
