Guides
Short, answer-first guides to signup abuse, free-trial abuse and form spam, with code you can paste. Last updated 2026-10-26.
How to stop free-trial abuse in a SaaS or AI app
Link each new signup to accounts already created from the same browser, device or mailbox, then give repeats a smaller trial instead of blocking them. Normalize email aliases, flag disposable domains, run in watch-only mode for two weeks, and fail open with a reduced grant when the check is unavailable. A CAPTCHA does not stop one human with many inboxes.
How to detect repeat signups without storing raw emails or IPs
Hash the identifiers you link on, per site, and never keep the raw values. Fold email aliases before hashing, store network identifiers as salted hashes, keep a first-party visitor id, and expire links after 30 days. Nolgard works this way: raw IPs are not stored, links are per-site hashes, and events are deleted after 14 to 90 days.
How to stop form spam without a CAPTCHA
Score each submission on your server from signals the visitor never sees: a browser check token, a hidden decoy field, time to submit, the email domain and the network. Reject clear bots, send doubtful ones to email confirmation, and accept the rest. This removes the puzzle for real people while keeping a server-side verdict you can log.
Signup abuse signals: what to check before you create an account
Check four groups before you create the account: automation (headless browser, scripted input, filled decoy field), repeats (same device, browser or mailbox as earlier accounts), email quality (disposable, newly registered or alias domain) and network (many signups from one network in a day). No single signal is proof; combine them into a graded decision.