How to Stop Fake and Bot Signups on Your Email List and Forms

You check your newsletter list on Monday and find 300 new subscribers from the weekend. Exciting, until you look closer: [email protected], a first name of "aSdFgHjK," and dozens of signups within the same few minutes. Those aren't new fans. They're bots.

Fake signups waste money, wreck your stats and can damage your ability to reach real people's inboxes. This guide shows how to recognize them, the layers of protection you can add to your forms (from easy to more technical), and how to clean out the fakes that already got in.

Why fake signups are a real problem

It's tempting to shrug off a few junk contacts. But they cost you in several ways:

• Bounces. Made-up addresses don't exist, so your next email to them bounces. A pile of bounces tells mailbox providers you don't keep a careful list.
• Complaints. Some bots sign up real people's addresses. Those people never asked for your mail and may report it as spam.
• Money. Many email services price plans by number of contacts. You end up paying to store and mail addresses nobody reads.
• Bad numbers. Open and click rates fall because a chunk of your list can't or won't engage, so you can't tell what's working.

Signs of bot signups

Look through recent signups in your email service or form tool. Bots tend to leave fingerprints like these:

• Gibberish names. Random letters, mixed capitals, or a name field filled with a URL or the same text as the email.
• Bursts. Dozens or hundreds of signups in minutes, often overnight, with no campaign or social post to explain them.
• Nonsense addresses. Long strings of random characters, like qz8v1kpl0w@..., or obvious patterns like test123@, test124@, test125@.
• Throwaway addresses. Domains from disposable email services that create temporary inboxes which disappear after a short time.
• Every field filled the same way. Identical phone numbers, the same city, or the same message text across many signups.
• No confirmations. If you use confirmed opt-in, a sudden pile of unconfirmed signups is a big red flag.

A special case: list bombing (subscription bombing)

Not every bot signup is meant to hurt you directly. In list bombing, also called subscription bombing, an attacker uses bots to sign a victim's real email address up for many websites' forms at once. The victim's inbox gets flooded with welcome and confirmation emails, sometimes to bury an important message such as a security alert or a purchase receipt the attacker doesn't want them to see.

Your form becomes one of the tools in the attack. The victim gets an email from you they never wanted, and your business looks like a spammer. If you send a full welcome series right away, you add even more mail to the flood. Signs include a spike in signups using real-looking addresses at well-known providers, often all within a short window. The defenses below help with both ordinary junk signups and list bombing.

Turn on double opt-in (confirmed opt-in)

If you only do one thing, do this. With double opt-in, also called confirmed opt-in, a new subscriber gets one email with a confirmation link. They're only added to your list after they click it.

• Made-up addresses can't click, so they never join.
• Typos like [email protected] never get confirmed, so they don't pollute your list.
• A real person signed up by a bot simply ignores the one email, and you never write to them again.

Most email marketing services offer double opt-in as a setting on each list or form. Keep the confirmation email short and clear ("Click to confirm you want our weekly tips"), and make the button obvious. You'll lose a few real people who never click, but the people you keep are real and interested.

Add a honeypot field

A honeypot is a trap field that humans can't see but simple bots will fill in. It's free and invisible to real visitors.

1. Add an extra field to your form, with an ordinary-sounding name like "website" or "company_url."
2. Hide it from people using your site's styling, so it doesn't show on screen. Mark it so screen readers skip it and browsers don't autofill it.
3. Set your form to reject or quietly discard any submission where that hidden field has something in it.

Many form builders and website plugins include a honeypot option, so check your settings before building one by hand. Honeypots stop the lazy bots that fill every field. Smarter bots may skip them, which is why it's one layer, not the whole plan.

Use a CAPTCHA, ideally one people barely notice

A CAPTCHA is a check that tries to tell humans from bots. The old style made people type wobbly letters or click every traffic light. Newer options mostly work in the background:

• Score-based checks. Google's reCAPTCHA v3 doesn't show a puzzle. It gives each submission a score from 0.0 (very likely a bot) to 1.0 (very likely good), and your form decides what to do with low scores.
• Puzzle-free challenges. Cloudflare Turnstile runs checks in the visitor's browser and only shows a checkbox when something looks off. It can be added to any website, not only ones that use Cloudflare.
• Classic checkbox or image challenges. Still available from several providers. They work, but they annoy people and can be hard for some visitors to complete.

Most form builders and email signup tools have a CAPTCHA option built in. Turn it on, test the form yourself on a phone and a computer, and make sure real people can still sign up easily.

Limit how fast signups can arrive

Rate limiting means capping how many submissions your form accepts in a short time, either from one visitor or overall. A real person signs up once. A bot tries hundreds of times.

• If your website host, form plugin or security service offers rate limiting or "flood protection," turn it on.
• Set up a notification for unusual volume. Some email services can alert you to a spike, or you can simply check daily signups after you add a new form.
• If an attack is happening right now, it's fine to pause the form or switch it off for a day. A missing form costs less than a flood of junk.

Block disposable and junk domains

Disposable email services hand out temporary inboxes that vanish after a short while. Someone using one to grab your freebie was never going to read your newsletter.

• Many form tools let you block specific domains. Add the throwaway domains you see in your own signup data.
• Check that the email field requires a valid format (one @, a real-looking domain).
• Consider suggesting corrections for obvious typos at the form, like "Did you mean gmail.com?" so real people don't lock themselves out.

Domain blocklists need updating because new disposable services keep appearing, so treat this as a filter that catches the familiar ones, not a complete wall.

Clean out the fakes already on your list

Protecting your form stops new junk. You still need to remove what's already there.

1. Export your recent signups with the signup date and time, plus any name fields.
2. Sort by signup time. Bursts jump out when rows are side by side. Look for clusters of gibberish names or random addresses.
3. Remove unconfirmed contacts if you use double opt-in. People who never confirmed shouldn't be mailed.
4. Fix real typos before you throw anything away. The typo fixer repairs domains like hotmial.com and .con, which are often real people, not bots.
5. Check what's left. Gibberish names don't always mean a fake address, and normal-looking addresses can be dead or disposable. You can verify the whole list with Veml, which flags throwaway addresses, invalid formats, domains that can't receive mail and mailboxes that don't exist, without sending any email.
6. Remove the fakes everywhere. Put the bad addresses in one list and use the compare lists tool to remove them from your main list. Then add them to your suppression list so they can't be imported again.

A simple protection plan

You don't need everything at once. Start with double opt-in and a honeypot, which cost nothing and stop most junk. Add a background CAPTCHA if bots still get through. Turn on rate limiting and domain blocking when your form gets busier or you see an attack. Then check your signups weekly for bursts, and run a full list check whenever something looks off. Real subscribers will barely notice any of it, and your list will stay full of people who actually want to hear from you.