How We Blocked 1,000s of Spam Signups (While Lowering UX Friction)
Building a public-facing tool like a link shortener is an open invitation for bots. Last week, we saw a 400% spike in automated registration attempts. The goal of these bots is simple: create thousands of "legitimate" looking accounts to blast spam links across the web.
If we did nothing, our database would be bloated with junk, and our domain reputation would be ruined by midday.
However, the "old way" of fighting bots — blurry fire hydrants and clicking on traffic lights — is a UX nightmare. We wanted to build a fortress that bots couldn't crack, but that real users would never even notice.
Here is the multi-layered defense system we built for Peeksy that resulted in 7,000+ requests with 0 errors and a perfectly clean registration log.
1. The Invisible Shield: Cloudflare Turnstile
We swapped traditional CAPTCHAs for Cloudflare Turnstile.
Unlike Google's reCAPTCHA, Turnstile doesn't require users to solve puzzles. It uses a combination of browser challenges and telemetry to verify "humanness" in the background.
The Result: 100% of the security with 0% of the friction. If Turnstile doesn't issue a valid token, the POST request to our auth endpoint is rejected before it even hits our API logic.
2. Honey-Potting & Registration Timing
Bots are fast. Humans are (relatively) slow. We implemented two "behavioral" checks:
Form-Fill Timing: If a user submits the registration form in under 2.5 seconds, they are almost certainly a script. We silently flag these accounts for immediate review.
Hidden Fields: We include "honey-pot" fields that are invisible to humans but visible to bot scrapers. If that field is filled out, the request is dropped.
3. ASN Gating and Proxy Detection
Most spam networks operate out of cheap datacenters or known proxy ranges. Using Cloudflare's visitor headers, we check the ASN (Autonomous System Number) of every signup.
If a signup comes from a known "high-risk" datacenter range, we don't necessarily block them (to avoid false positives), but we require mandatory email verification before a single link can be shortened.
We also cross-reference emails against a real-time list of disposable email providers. If you're using temp-mail.org, you aren't getting in.
4. The "Strike" System & Admin Isolation
Security doesn't stop at the "Create Account" button. We built a separate, isolated Admin API that runs on a different JWT secret. This allows us to moderate the platform without any risk of privilege escalation.
Automatic Flags: Suspicious slug patterns (e.g., amazon-login-update-2026) trigger an automatic "strike."
The Wall: At 3 strikes, the account is restricted. Crucially, we moved our link redirects to the Edge (Cloudflare Workers). When an account is restricted, the Edge KV store is updated instantly, and those links stop resolving globally in milliseconds.
5. The Metrics
The result of this hardening?
- CPU Time: 4.16ms average
- Error Rate: 0.0%
- Database Junk: 99% reduction in fake accounts
The Takeaway
Don't wait for a spam attack to build your defense. By moving your security to the Edge and using invisible challenges like Turnstile, you can protect your infrastructure without punishing your users.
Check out the live dashboard at peeksy.space