Sign-up bots: CAPTCHA, honeypot or verification?
Every public sign-up form attracts bots: fake accounts, made-up addresses and other people’s addresses signed up in bulk. This guide shows what CAPTCHA, honeypot and rate limits really stop, where they end and why a verified sender keeps bots out of your list.
- What bots want from your form
- Four measures compared
- Verification as the last layer
Christian Schätzlein, Founder and developer of Sendity
3 min read
Which sign-ups came from bots?
Tap the suspicious sign-ups, then reveal.
-
Human Form filled in 48 seconds.
-
Bot Filled the hidden honeypot field that only bots see.
-
Bot Form filled in 0.8 seconds.
-
Bot Same minute, address counted up: a script.
-
Human Looks fine.
-
Cannot tell Looks real. Whether a person or a CAPTCHA-solving service filled it in, no list can tell.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Bots do not sign up out of interest. They fill in forms because something is in it for them, or to harm someone else.
Why bots sign up
Accounts for spam, free trials and coupons, extra chances in giveaways. Or list bombing: bots enter a victim’s address on thousands of forms, and your confirmation email becomes part of the attack.
CAPTCHA
Stops simple scripts. Solving services pass it for a small fee, and real visitors pay with time and patience. Services like Google reCAPTCHA send visitor data to a third party, which needs a privacy review in the EU.
Honeypot and timing
A hidden field that only bots fill in, plus a minimum time to complete the form. Free and invisible to people, but any bot written for your form skips both.
Rate limits
A few sign-ups per IP address and minute slow down bulk attacks. Botnets rotate thousands of addresses, and offices or mobile networks share one.
Verifying the contact
The first three filter requests. Verification checks the result: does the address or number really belong to whoever signed up? With reverse OTP, the visitor sends a code via WhatsApp or email, so a bot needs a real account that can send.
Layers instead of one barrier.
No single measure stops every bot. Together they make each fake sign-up expensive.
Filter the cheap ones
Honeypot and minimum time cost nothing and catch most generic scripts.
Slow down bulk
Limits per IP address and per contact keep a single source from flooding your form.
Verify the sender
Only a contact who has sent a message from their own account ends up in your list.
CAPTCHA or verified sender?
A CAPTCHA asks whether a person is present. Verification asks whose contact it is.
| Aspect | CAPTCHA | With Sendity |
|---|---|---|
| What a bot needs | A solving service | A working WhatsApp account or mailbox per sign-up |
| What ends up in your list | A typed, unchecked address | The verified sender |
| Other people’s addresses | Get your confirmation email | Get nothing: you send nothing |
| Effort for people | Solve a puzzle, then confirm | Tap send once |
What a verified sender changes.
When the contact comes from the message, bots lose their cheapest tricks.
No puzzles for people
Visitors tap send instead of clicking traffic lights.
No list bombing
You do not send to typed addresses, so bots cannot aim your emails at a victim.
One contact, one entry
Allow each verified number or address once, and a bot account brings one entry at most.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Sign-up bots: common questions.
Is a honeypot enough?
Against generic scripts often yes. Once someone targets your form, it no longer helps. Keep it as a free first layer.
Can a bot send a WhatsApp message?
Yes, if it controls a real WhatsApp account. Each account needs a working phone number. If you allow every verified number once, one account brings one entry.
And with email?
Sendity checks that the email really comes from the mailbox (DKIM). Someone with their own domain can still create many mailboxes, so combine email with limits per domain where that matters.
Do I still need a CAPTCHA?
Not in front of the verification: a bot that does not send a message gets nothing, and you pay nothing. For other forms on your site, it can still make sense.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Sign-ups with a verified sender.
Try the live demo on your phone. It takes ten seconds.