Prevent signup abuse

Stop automated account creation, trial farming, and waitlist flooding at the front door. Attackers spin up disposable mailboxes to claim free trials or exhaust waitlist slots; a CAPTCHA plus a signup-abuse monitor makes this expensive and visible.

What you use

• Bot protection with reCAPTCHA v3 on signup and waitlist.
• The Lidar repeat_signup monitor (detection:repeat_signup priorAccounts:>2), correlated by IP.

Setup

1. Register a reCAPTCHA v3 site for the domains that serve your auth pages, including any custom domain.
2. In the console, open Authentication > Add-ons > Google reCAPTCHA, enter the site and secret keys, and select the signup and waitlist actions.
3. Start with a permissive minimum score (the default 0.5) and tighten after watching real traffic.
4. Under Lidar > Monitors, enable repeat_signup and lower priorAccounts if your signup volume is low and the default of 2 never fires.

Verify

• In a dev environment, hit the hosted sign-up page with a script that reuses one IP across several sign-ups: v3 rejects low-score attempts, and repeat_signup raises a Signal once priorAccounts is exceeded.
• Confirm a real sign-up from a fresh browser still passes; a too-high minimum rejects legitimate users on shared networks and privacy-hardened browsers.
• Check the Lidar Signals view for the finding, then triage or dismiss it so the dedup key (ai:repeat_signup:<subject>:<windowStart>) does not keep refreshing.

Related

• Stop credential stuffing: the same front-door control aimed at sign-in.
• Bot protection: full reCAPTCHA reference and rollout order.
• Lidar concepts: how repeat_signup correlates and dedups.