When Lynkle first launched, we kept the signup flow as frictionless as possible: no email verification, no CAPTCHA, no hoops to jump through. The goal was simple: make it as easy as possible for real users to create their digital business card. And it worked, for a while.
The spam problem
Within weeks, we noticed a growing problem: spam signups. We were seeing 50 to 100 spam signups per day, polluting our database and skewing our metrics. After analyzing the patterns, we identified two primary sources:
- Bots (~70%): Automated scripts creating accounts with fake email addresses, often using disposable email services. These bots would sign up, sometimes create cards with spammy links, and move on.
- SEO agencies (~30%): Real people (or semi-automated tools) creating accounts to add backlinks to their clients' websites through card profiles. These were harder to detect because they used real email addresses and behaved more like legitimate users.
The defense strategy
We needed a layered approach that would stop the vast majority of spam without adding significant friction for real users. Here's what we implemented, in order:
- Cloudflare Turnstile: We replaced traditional CAPTCHAs with Cloudflare Turnstile, a privacy-first, non-interactive challenge. Unlike reCAPTCHA, Turnstile runs in the background and doesn't ask users to identify traffic lights or crosswalks. Most legitimate users never even notice it.
- Bot Fight Mode: We enabled Cloudflare's Bot Fight Mode, which uses machine learning to identify and block automated traffic before it even reaches our signup form. This stopped the most obvious bot traffic immediately.
- Honeypot fields: We added invisible form fields that real users would never see or fill in. Bots, which typically fill in every field they find, would trigger the honeypot and get rejected silently.
- Email verification: We added a required email verification step after signup. Users receive a verification code and must confirm their email before they can create a card. This was the most impactful single change, achieving a 98% verification rate among real users, meaning minimal conversion loss.
- Domain blocklist: We compiled and maintain a blocklist of disposable email domains and known spam TLDs. Signups using these domains are rejected at the form level with a helpful error message suggesting the user try a different email address.
We rolled these out in phases over several weeks, measuring the impact of each change before adding the next layer. This phased approach let us find the right balance between security and user experience.
Results
After implementing all five layers, spam signups dropped from 50–100 per day to 5–10 per week. That's a reduction of over 95%. More importantly, our legitimate signup conversion rate remained virtually unchanged. The 98% email verification rate confirmed that real users had no trouble completing the additional step.
Key takeaways
- Layer your defenses: No single measure stops all spam. A combination of bot detection, honeypots, email verification, and domain blocklists is far more effective than any one solution alone.
- Measure before and after: Track your signup conversion rate alongside spam volume. If a new measure drops conversions significantly, it may not be worth the trade-off.
- Choose invisible friction: Tools like Cloudflare Turnstile and honeypot fields add security without adding visible steps for real users.
- Email verification is worth it: We resisted adding it for months, worried about losing signups. In practice, 98% of real users verified their email without issue.
- Maintain your blocklists: Disposable email domains appear constantly. Regularly updating your blocklist keeps the remaining spam at bay.
Related reading
Ready to start your digital business card journey?
Get started for freeTrusted by the best
