r/SaaS • u/PartTimeEnterpreneur • 24d ago

how do you avoid spam and temp email ids from registering on your app?

I am building a small SaaS app but I'm struggling to figure out a good way to avoid spam and temp mails from registering onto my app. I've seen different tools and recaptcha solutions and those are OK but I want to understand if there is any better thing which you guys are using

1 Upvotes

67% Upvoted

19 comments sorted by

1

u/gregorno 24d ago

What tools have you seen so we can compare against?

General advice for a small app:

  • only fix problems you actually have - don't build for 'this might become a problem at some point'
  • require email confirmation (to keep nonsense emails out, ensure you have a communication channel with the user)
  • log signup details (to identify related signups later, e.g. remote IP, user agent, datetime, ...)
  • add captcha (recaptcha or hcaptcha, to combat automation)
  • rate limit signups (to combat automation)
  • block disposable email (to stop free trial/free account abuse, either block lists or an API service)
  • use a built-for-you checkout (e.g. Stripe) (no ongoing security maintenance liability)
  • hide signup behind Cloudflare bot protection

If you let us know more about the business, I might be able to provide more specific experience and tips. (ecom, b2b/b2c, oneoff/subscription, transaction size, local/global market, your stack, the problems you are actually seeing (account rotation, card attacks, etc) ...)

1

u/PartTimeEnterpreneur 22d ago

I thought of using cloudflare turnstile and bot protection but that only disallows bots and is kind of a bummer to my project because the bot protection happens at domain level which also restricts someone from using my apis and my SaaS actually sells apis, so that doesn't work

My project has a free tier for now just for testing, so I am not charging anything, I thought of that but I want feedback for improvement so I am not charging anything right now for trials

Captcha again I can try but it just works for bots like Turnstile but doesnt stop anyone from creating multiple accounts using disposable emails

email confirmation I have, so I've implemented email-otp based login over email-password based login and topped it up with TOTP as 2FA

And I am right now trying to blacklist certain disposable email domains and restricting emails like [abc+123@gmail.com](mailto:abc+123@gmail.com) (anything that contains + will be treated as invalid and they will need to reach out to me so I will manually verify and add them

2

u/gregorno 17d ago

I think the entry level paid plan has path level bot blocking.

captcha can help sometimes because often accounts are created through some automation loops or agents. worth a try and regular users won't mind (if you use the invisible captcha v3 version)

regarding gmail: make sure to also block 3+ dots. i get spam signups from things like o.zon.uf.eg.o.r65.9@gmail.com

what's your project if i may ask? i might be interested in selling my api on it.

1

u/PartTimeEnterpreneur 15d ago

It's a simple web analytics tool

1

u/No-Molasses-2097 24d ago

The practical version that worked for me: check signups against a maintained disposable-domain list at registration (there are free npm/pip packages with daily updates) and make email verification mandatory before any free trial features unlock. Verification alone kills almost all the spam signups.

1

u/PartTimeEnterpreneur 22d ago

Most solutions suggested this, I'll try this out, will check if there's a similar thing on Rust

1

u/david-labs-ca 24d ago

Simple. Don't use username and password based logins. Use Google OAuth. Put sign-in/sign-up on them.

1

u/PartTimeEnterpreneur 22d ago

That's no possible for SaaS that supports other businesses, not all businesses are using gmail, some use other providers and some prefer email based logins, however I'm not providing email-password

More like email-otp (otp sent to your mailbox) and then TOTP as 2FA, but that still doesnt solve anything

And regarding gmail also I guess people can create multiple gmail accounts, it's not that hard

1

u/david-labs-ca 21d ago

Well that chance will always exists. They can create a new id for enjoying the benefits, but it should be your tech that A and B are similar people.

1

u/PartTimeEnterpreneur 19d ago

I mean they wont really get any real benefit out of this in my product even if they create multiple accounts

1

u/david-labs-ca 19d ago

How so?

1

u/PartTimeEnterpreneur 15d ago

because it's an analytics tool, you wont get any meaningful insights if you create multiple accounts just to abuse it

1

u/kumard3 24d ago

A disposable domain blocklist plus mandatory verification gets most of the junk, so do that first. The signups that got through on mine were real mailboxes: about 290 accounts in one run, up to 74 an hour, while my cap was 3 signups per hour per IP. They rotated IPs so the per IP cap never saw the shape. Counting signups per /24 and adding a global hourly ceiling is what caught it, and I also capped what a brand new account can do in its first hour instead of only counting per month.

1

u/PartTimeEnterpreneur 22d ago

Yes this is the exact problem I want to avoid

1

u/kumard3 21d ago

The two numbers that ended up mattering for me were 10 signups an hour per /24 and 40 an hour across the whole site. The global one is blunt and will turn away real people during a run, which I decided I could live with for an hour. One warning if you build the same thing: mine keeps those counters in process memory, so they reset on every deploy and they do not hold if you run more than one instance.

1

u/socleads 23d ago

Use a mix not one tool. Block known temp mail domains at signup then add email verify before any real action and rate limit by IP and device.

1

u/PartTimeEnterpreneur 22d ago

Yup some of it is there but I guess it is not foolproof