LaunchList
Start free
Contact Trust

Waitlist spam protection on every signup.

LaunchList's waitlist spam protection scores every signup for bots, throwaway inboxes and referral farming. Doubtful ones are held for you, and every contact gets a trust verdict.

Build your waitlistSee how it works

Free for your first 100 contactsNo credit card needed

At a glance

Updated

Plans
On every plan, from the first signup
Trust verdicts
Five tiers, from Verified to Fake, on every contact, with the signals behind each one on its record
Default setting
Balanced: clearly suspicious signups are held for review, and the rest pass straight through
Captcha
Your own Turnstile, reCAPTCHA or hCaptcha keys, off until you switch it on
One inbox, one contact
A plus tag on a large email provider, or a dot in a Gmail address, never makes a second contact
How it works

How fake waitlist signups get caught.

Signups from your Launch page, your embeds and the API all go through the guard, with nothing to switch on.

  1. Bots are stopped at the form

    Rate limits, a hidden field only bots fill in, a check for forms sent in under two seconds, and your captcha if you added one.

  2. The rest is scored

    A throwaway address and a burst of signups from one device or network each add to a score. One weak signal alone rarely stops anyone.

  3. Let through or held

    Clear signups join your list. Anything suspicious is held for you to approve or block, one at a time or a whole selection at once.
Held for review

Waitlist bot protection that leaves the close calls to you.

Until you approve or block it, a held signup stays out of everything that counts.

  • Off your bill

    Held and blocked signups never count toward your contacts or your bill, and they stay out of your Analytics.

  • Off the leaderboard

    A held signup has no place in line, cannot earn or give referral credit, and is sent no confirmation email.

  • Approved keeps their place

    Let a real person through and they join the line at the time they originally signed up.

  • Blocked gives back the credit

    Block a signup as spam and it is removed, along with any referral credit it earned for someone else.

When to use it

The launches that draw fake signups.

Bots go where a prize or a place in line is worth something.

A good fit when

  • Your referral rewards are worth having, like early access or a prize, so a fake friend is worth the trouble.
  • You invite people from the front of the line, so every fake signup near the front pushes a real person back.
  • Your form sits on your own site, where any script that finds the page can post to it.
  • A post about your launch is doing well, and a crowd you have never met is signing up at once.

Not the right fit when

  • You want to turn away whole countries or email domains. Those are rules on each form, set in the form builder.
  • You want to block signups from data centers or VPNs. LaunchList does not check whether a signup came from one.
  • You want suspicious signups removed without a look. A held signup stays where it is until you decide.
The details

The checks behind every trust verdict.

  • Choose how strict

    The Referral checks setting under Privacy & spam decides how much it takes to hold a signup: Off, Relaxed, Balanced or Strict. Strict holds anything borderline, and Off holds nothing.

  • Five verdicts you can overrule

    Every contact reads Verified, Valid, Unknown, Risky or Fake. Valid and Fake come only after you check their email or set the verdict yourself, and you can mark anyone as trusted or as fake.

  • Caught after the fact

    Every hour, signups are grouped by device. When several that each looked fine turn out to share one, their verdicts drop, and they recover if the group shrinks.

  • A throwaway list kept fresh

    Tens of thousands of throwaway email domains are recognized, and the list is refreshed every week as new ones appear.

  • Test without tripping it

    Signups you submit in test mode skip the checks, so filling in your own form ten times in a row never looks like an attack.

  • Webhooks and API

    Get a webhook when a contact's verdict changes, and read or override the verdict through the API.

In the docs: keeping fake signups out, the trust.changed webhook and overriding a verdict through the API.

FAQ

What founders ask about waitlist spam protection.

How do I stop bots from signing up to my waitlist?
LaunchList runs the bot checks for you on every signup. The setting that helps most on top of them is asking people to confirm their email, which waitlist forms do by default: a fake signup then needs a working inbox. If you are still being flooded, add a captcha or raise the strictness.
How does LaunchList decide a contact's trust verdict?
It weighs whether the person confirmed their email, how their signup scored on the spam checks, whether their device was used for several signups, and what a check of their email found, once you have run one. A contact who confirms later moves up to Verified, as long as nothing counts against them.
Does LaunchList spam protection include a captcha?
Yes, with your own keys. Add Turnstile, reCAPTCHA or hCaptcha keys to a project and set the captcha to On, and the challenge appears on your signup forms; Test shows it without blocking anyone. It stays off until you do, because a captcha costs real signups and most launches do not need one. It is only asked for where it can appear, so a missing widget never blocks a form.
Will waitlist spam protection block real people?
On the default setting, a signup is refused outright only for a failed captcha, a filled-in bot trap, too many attempts in a short time, or several strong signals at once. Anything less certain is held, so a real person caught by a check usually waits for your approval instead of being turned away.
Do plus addresses count as separate waitlist signups?
No. A plus tag on Gmail, Outlook, iCloud and other large providers, and the dots in a Gmail address, are folded into one mailbox, so a.b+1@gmail.com and ab@gmail.com are one contact with one place in line and one referral credit. The address is kept as they typed it.
Is spam and fraud protection on the Free plan?
Yes. Every check, the trust verdict and the held queue work the same on the Free plan as on any other.

Keep your waitlist real.

Your first signup is checked like your ten thousandth.

Build your waitlist

Free for your first 100 contactsNo credit card needed