Original Summary

Bot detection on a SaaS signup form used to mean a CAPTCHA plus a honeypot field. Most of what gets through now is a real browser driven by a script or an AI agent, often on a residential IP, and it fills the form the way a person would. Cloudflare said this summer that automated traffic is now more than half of all web requests. On a signup form that shows up as spam signups that never activate, bounced welcome emails, free credits burned by accounts nobody owns, and an activation rate that looks worse than it is. Here's where each standard fix breaks: CAPTCHA. Solving services and AI agents get through it cheaply. The people it reliably stops are your real users on a phone, and every one of them pays for it with a slower signup. Honeypot fields. Great against dumb scripts that post straight to your endpoint. A headless browser or an agent renders the page, never sees the hidden field, and never fills it. Rate limits by IP. Residential proxies give every signup its own IP, so the limit never trips. Meanwhile a whole office or a university sits behind one address and hits it. Email verification. Proves someone controls an inbox, not that a person is behind the signup. Catch-all domains and Gmail aliases make fresh verified inboxes basically free. And there's a new wrinkle: not every bot is bad anymore. Some of these are AI agents a real customer sent to sign up or book something for them. "Block all bots" used to be the safe default. Now it can mean turning away a paying user who just delegated the task. My guess is the answer is looking at several signals together and only adding friction when a few of them look off, instead of making everyone solve a puzzle. But I'd rather hear what actually held up in production. So, for anyone running a signup form: What finally cut spam signups for you, and what did you try before that didn't? What was the first sign bots were getting in: bounce rate, dead accounts, burned credits, a weird spike? Do you put friction on every signup or only on suspicious ones? What did that do to conversion? Do you let AI agents sign up on behalf of real users, or block them all? More interested in what you tried and what broke than in tool names.   submitted by   /u/Enryu21 [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/4 22:33:45