Prevent signup abuse

Stop automated account creation, trial farming, and waitlist flooding at the front door. Attackers spin up disposable mailboxes to claim free trials or exhaust waitlist slots; a CAPTCHA plus a signup-abuse monitor makes this expensive and visible.

What you use

• Bot protection with an invisible challenge on signup and waitlist: reCAPTCHA v3, or Cloudflare Turnstile Invisible.
• The Lidar repeat_signup monitor (detection:repeat_signup priorAccounts:>2), correlated by IP.

Setup

1. Register a reCAPTCHA v3 site or a Turnstile Invisible widget for the domains that serve your auth pages, including any custom domain.
2. In the console, open Authentication > Add-ons, choose Google reCAPTCHA or Cloudflare Turnstile, enter the site and secret keys, and select the signup and waitlist actions.
3. For reCAPTCHA v3, start with a permissive minimum score (the default 0.5) and tighten after watching real traffic. For Turnstile, set widget mode to Invisible and match the widget you created in Cloudflare.
4. Under Lidar > Monitors, enable repeat_signup and lower priorAccounts if your signup volume is low and the default of 2 never fires.

Do not enable both add-ons for the same action. If you do, reCAPTCHA is used.

Verify

• In a dev environment, hit the hosted sign-up page with a script that reuses one IP across several sign-ups: the invisible challenge rejects automated attempts, and repeat_signup raises a Signal once priorAccounts is exceeded.
• Confirm a real sign-up from a fresh browser still passes; a too-high reCAPTCHA minimum rejects legitimate users on shared networks and privacy-hardened browsers.
• Check the Lidar Signals view for the finding, then triage or dismiss it so the dedup key (ai:repeat_signup:<subject>:<windowStart>) does not keep refreshing.

Related

• Stop credential stuffing: the same front-door control aimed at sign-in.
• Bot protection: reCAPTCHA and Turnstile reference and rollout order.
• Lidar concepts: how repeat_signup correlates and dedups.