Ask HN: My signup form is being bombarded by bots. What do I do?

[anon8588]

My sign up form is being filled by automated bots/scripts that are signing up using other people's emails. This means that the confirmation email my app sends out get flagged by the email owners as spam, hurting my domain reputation and email sending limits.

So far, I've tried Google Recaptcha which has reduced the rate but has not eliminated it, even at the maximum filtering level. The rate of fake sign ups is still high enough to cause email reputation problems for me. What do I do?

[undyingtrillion]

Ban IPs. If they are largely coming from a country you are not marketing in, consider blocking off that country as a "stop the bleeding" measure.

See what other patterns you find and ban IPs based on those.

Edit: I also remember people putting in fake fields that are not visible to the user. If they have any value in the form submission they are scripts and can be rejected.

[anon8588]

Thanks. I am looking in how I can throttle sign ups by IP address without causing problems for legitimate users.

I've yet to try the "hidden fields" honeypot.

[emedchill]

- use CSRF tokens

- route throttling to something high since if they are new users they shouldn't need to hit that form more than once

- don't let the end user know that you were able to send an email. Keep it vague like "if your email exists, you should receive an email soon."

- don't use a personal email server; something like sendgrid can give you a server that is in good/neutral standing

- if you have to handle your own emails, keep up with any bounce backs and always keep an eye your server being on any blacklists to get it cleared out as soon as possible

- honeypots can be useful if the spammer(s) isn't keeping a close eye on their scripts

- put your site behind a DDoS service

[emedchill]

> don't let the end user know that you were able to send an email.

I need to stress this is a very important point. If you happen to state the email they entered already exists in the system, the attacker now knows that is a valid account then use a known password linked to that email to gain access.

[ngshiheng]

I've had good experience with Cloudflare Turnstile. HIPB did something similar before too: https://www.troyhunt.com/fighting-api-bots-with-cloudflares-...

[LinuxBender]

I think people would need you to provide more details to give some suggestions such as:

- Is your site behind a CDN and if so which one?

- What is your web server tech stack? i.e. Linux, NGinx/Apache, application language and do you manage it or a 3rd party?

- Any other details such as how the form fields are generated, etc...

[anon8588]

ASP.NET behind Azure Frontdoor.

The only pattern I see consistently with such sign ups is that their name and email does not match if you read closely. I don't know enough about Azure Frontdoor functionality to be able to fix this myself.

[LinuxBender]

Unfortunately I have nothing to add to that but if you still have the option to edit your submission it may be worth adding those details to your original question.