Bot detection on a SaaS signup form used to mean a CAPTCHA plus a honeypot field. Most of what gets through now is a real browser driven by a script or an AI agent, often on a residential IP, and it fills the form the way a person would.
Cloudflare said this summer that automated traffic is now more than half of all web requests. On a signup form that shows up as spam signups that never activate, bounced welcome emails, free credits burned by accounts nobody owns, and an activation rate that looks worse than it is.
Here's where each standard fix breaks: CAPTCHA reliably stops your real users on a phone. Honeypot fields don't catch headless browsers that render the page properly. Rate limits by IP catch a university but miss a residential proxy service. Email verification proves someone controls an inbox, not that a person is behind the signup.
And there's a new wrinkle: not every bot is bad anymore. Some of these are AI agents a real customer sent to sign up or book something for them. "Block all bots" used to be the safe default. Now it can mean turning away a paying user who just delegated the task.
So, for anyone running a signup form: what finally cut spam signups for you, and what was the first sign bots were getting in? Do you add friction for everyone or only when something looks off? And do you let AI agents sign up on behalf of real users?
Top comments (2)
Good overview of why CAPTCHA plus a honeypot stopped being enough. From building chatform.in I'd add that the form's shape matters: a multi-step conversational flow gives more behavioural signal per submission than a single POST, since each answer has its own timing and context. Have you seen LLM-driven bots get through multi-step flows yet?
Residential IPs break a lot of CAPTCHA-first heuristics. We've had better luck treating proxy/VPN/dial-up-pool evidence as time-bounded rather than a permanent label, and combining that with shared-exit context so you don't ban a whole CGNAT range for one bad actor.
We open-sourced the lookup shape at IP99 (ip99.com) if useful as a second opinion next to your bot signals — free tier, no key: curl ip99.com/v1/ip/8.8.8.8