What does Laposta do against fake subscriptions?
Public subscribe forms are a popular target for bots. They automatically fill in email addresses, which are often fake or stolen. Without a filter, those addresses end up in your list and pollute your subscriber database. If you subsequently send a newsletter to addresses that do not exist, this damages both your sender reputation and that of Laposta.
That is why Laposta filters out such subscriptions as thoroughly as possible. A bot does not notice this: it simply sees the thank you page or a success message, but the address is not added to your list.
Protection per type of form
Protection usually works automatically, as long as the corresponding script is included in the form.
For plain HTML on your own website, the validate.js script is important. It retrieves a one-time token, solves a computational puzzle and collects behavioural signals. Without this script, your form has only limited protection.
Laposta deliberately does not use third-party captchas, such as reCAPTCHA. These often require consent under the GDPR and send your visitors’ data to another party. You therefore do not need to add one yourself either.
How does Laposta recognise bots?
A bot is often a script that searches for and fills in forms, but increasingly it is a regular browser controlled by a program. That is why Laposta combines a series of checks. A single check is not always enough, but together they stop most bots.
- Rate limit: only a limited number of subscriptions per minute and per hour can be submitted from a single IP address or on a single form. In the event of a sudden surge, the extra attempts are ignored.
- One-time token: upon submission, the form requests a unique, briefly valid code. This is tied to your account, your list and, where possible, the visitor’s network. A simple bot does not request this code or reuses it.
- Computational puzzle: along with the token, the browser receives a small puzzle that is solved in a fraction of a second. The visitor does not notice anything, but a bot has to solve it again for every subscription. This makes mass submissions costly.
- Browser behaviour: the system checks whether there was genuine interaction, such as touched fields, mouse or touch movements and the speed of submission. Signals indicating an automated browser are also taken into account.
- Hidden field: the form contains a field that a human cannot see and therefore does not fill in. If a bot fills it in, the subscription does not count.
- Submitted too quickly: a subscription that arrives inhumanly fast after loading is almost always automated.
- Blocklists: Laposta maintains lists of abused IP addresses, networks and email domains, including known Tor exit nodes and disposable addresses. The helpdesk can add addresses or domains to these lists.
- Email address check: in addition to the standard validity check, the filter looks for patterns commonly associated with spam, such as random-looking addresses.
- Country rule, on request: if a list suffers heavily from spam, the helpdesk can block a country or only allow subscriptions from specific countries.
Are you still experiencing fake subscriptions?
If strange addresses are still getting through, please email helpdesk@laposta.nl. Mention which list is affected and which form you are using: plain HTML, embedded, standalone, a plugin or the API. The helpdesk will then look into it with you.