---
title: "Stop bot signups and prevent spam complaints and delivery issues"
description: "Bot signups cause spam complaints and damage your sender reputation. Learn how CAPTCHA, honeypots and IP blocking protect your forms."
url: "https://lettermint.co/knowledge-base/deliverability/stop-bot-signups-prevent-spam-complaints"
published: "2026-01-06"
last_updated: "2026-01-06"
---

# Stop bot signups and prevent spam complaints and delivery issues

> Bot signups cause spam complaints and damage your sender reputation. Learn how CAPTCHA, honeypots and IP blocking protect your forms.

It's happening everywhere: a spike in new signups on your platform, followed
by a wave of *spam complaints*. The cause? **Bots using real people's email
addresses to create accounts**.

This problem has been around for years, but since late 2025 it has grown
rapidly. We see it with our customers, but it's happening worldwide. More
and more businesses notice their *spam complaints* rising without a clear
reason. The cause is often the same: automated bot attacks on registration
forms.

The owners of those email addresses never signed up. They suddenly receive a
welcome email from a service they've never heard of. What do they do? Mark
it as spam. And why wouldn't they? They never asked for it.

The problem is that you're the one who suffers. Every *spam complaint* counts
against your sender reputation. That reputation determines whether your
emails land in the inbox or the spam folder. Not just your welcome emails,
but all your
[transactional emails](https://lettermint.co/features/transactional-emails).
Password resets, order confirmations, invoices.

In this article we explain how *bot signups* work, why they damage your
sender reputation, and what you can do to stop them.

![Lettermint Spam Complaint](https://lettermint.co/content/knowledgebase/lettermint-spam-complaint.webp)

## How bot signups work

Bots (automated scripts) scan the internet looking for forms. When they find
a registration form, they fill it out automatically. Often with email
addresses they've collected or purchased elsewhere.

The goal differs. Sometimes they want access to a free service or trial.
Sometimes they want to send spam through your platform. And sometimes it's
purely to cause harm to the email address owner. This last one is called
*email bombing*: flooding someone's inbox with hundreds of signup
confirmations from different services.

For you as the sender, the goal doesn't matter. It all leads to the same
thing: you're sending emails to people who never asked for them. And that
causes problems, because those emails get marked as spam.

### Why welcome emails?

Welcome emails are the perfect target for bots. They're sent immediately
after signup, without any extra verification. The recipient has no idea
where the email came from and marks it as spam.

With other emails like order confirmations or invoices, there's always an
action beforehand. Someone bought something or used a service. With a
welcome email after registration, that barrier doesn't exist.

## Why bot signups damage your sender reputation

Email providers like Gmail and Outlook track exactly how recipients respond
to your emails. Do they open them? Click through? Or mark them as spam?

That last one hurts. Every *spam complaint* counts against your sender
reputation. The more complaints, the higher the chance your emails end up in
spam folders. **Not just for the person who complained, but for all your
recipients.**

Example: a bot creates 500 accounts using real people's email addresses. You
send 500 welcome emails. If some of those people mark your email as spam,
you have a problem.

And this doesn't just affect your welcome emails. Your entire sender
reputation drops. As a result, your password resets, order confirmations and
other
[transactional emails](https://lettermint.co/features/transactional-emails)
also become less likely to arrive.

It's easy to ignore a few complaints. But a damaged sender reputation takes
time to rebuild. Weeks, sometimes months. During that time, your customers
miss important emails.

## What can I do to stop bot signups

You can block bots in several ways. There's no bulletproof solution, because
bots keep getting smarter. But with the right approach, you can keep most of
them out.

**Start with a CAPTCHA**. It has a big impact and works in almost any
situation, including CMS platforms like WordPress. For extra protection, you
can combine multiple techniques.

### CAPTCHA

You probably know them: those checkboxes where you confirm you're not a
robot, or puzzles where you select traffic lights. That's a CAPTCHA. The
user has to prove they're human **before the form gets submitted**.

<table>
<thead>
  <tr>
    <th>
      CAPTCHA
    </th>
    
    <th>
      Free
    </th>
    
    <th>
      Region
    </th>
    
    <th>
      Self-hosted
    </th>
    
    <th>
      Notes
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Google reCAPTCHA
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      US
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Widely supported, data goes to Google
    </td>
  </tr>
  
  <tr>
    <td>
      Cloudflare Turnstile
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      US
    </td>
    
    <td>
      No
    </td>
    
    <td>
      More privacy-friendly, EU data storage option
    </td>
  </tr>
  
  <tr>
    <td>
      hCaptcha
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      US
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Privacy alternative, offers EU option
    </td>
  </tr>
  
  <tr>
    <td>
      Friendly Captcha
    </td>
    
    <td>
      No
    </td>
    
    <td>
      EU (Germany)
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Fully GDPR compliant
    </td>
  </tr>
  
  <tr>
    <td>
      ALTCHA
    </td>
    
    <td>
      No
    </td>
    
    <td>
      EU (Czechia)
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Open source
    </td>
  </tr>
  
  <tr>
    <td>
      mCaptcha
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      -
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Open source
    </td>
  </tr>
</tbody>
</table>

### Honeypot fields

A *honeypot* is a hidden field in your form. Real users don't see it and
won't fill it in. Bots often fill in everything, including hidden fields. If
the honeypot field is filled in, you know it's a bot.

This works well against simple bots, but more advanced bots won't fall for
it anymore.

### Blocking IP addresses

You can check IP addresses through services like
[AbuseIPDB](https://www.abuseipdb.com/). There you can see if an IP address
has been reported for spam or abuse. IP addresses from known bots, VPNs or
TOR networks are often flagged there.

<callout type="info">

For developers: you can use the AbuseIPDB API to automatically check if an
IP address is on a blacklist during signups.

</callout>

## What Lettermint does

### Visibility

At Lettermint, we monitor *spam complaints* for all our customers. When a
recipient marks your email as spam, we catch that report. You'll see it
right away in your dashboard, so you know when something's off.

<callout type="info">

Through our [API](https://docs.lettermint.co) and
[webhooks](https://docs.lettermint.co/platform/webhooks/introduction) you can
catch this automatically. That way you're notified instantly.

</callout>

### Suppressions

We also automatically add these email addresses to the
[suppression list](https://lettermint.co/changelog/improved-suppressions-management). This
prevents another email from going to that address and making things worse.

### Alerting

Is the ratio between successful emails and complaints becoming problematic?
We step in and let you know. That way you can take action before your sender
reputation takes even more damage.

## Conclusion

Bot signups are a growing problem that can damage your sender reputation.
Bots use real people's email addresses to create accounts. Those people
receive your welcome emails and mark them as spam.

The solution starts with your forms. Add a CAPTCHA, use honeypot fields and
block suspicious IP addresses. None of these measures are bulletproof, but
together they make it much harder for bots.

Dealing with *spam complaints* and not sure where they're coming from? Check
your dashboard for unusual spikes in signups. Bots are likely the cause.
