> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.laposta.org/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.laposta.org/_mcp/server. # What does Laposta do against fake subscriptions? > Laposta automatically filters spam subscriptions from bots out of your subscribe forms, without a captcha. Public subscribe forms are a popular target for bots. They automatically fill in email addresses, which are often fake or stolen. Without a filter, those addresses end up in your list and pollute your subscriber database. If you subsequently send a newsletter to addresses that do not exist, this damages both your sender reputation and that of Laposta. That is why Laposta filters out such subscriptions as thoroughly as possible. A bot does not notice this: it simply sees the thank you page or a success message, but the address is not added to your list. ## Protection per type of form Protection usually works automatically, as long as the corresponding script is included in the form. | Form | Protected against bots | What do you need to do? | | -------------------------------------------------------------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Standalone subscribe form](/hoe-pas-ik-het-zelfstandig-aanmeldformulier-aan) | Yes, by default | Nothing | | [Embedded subscribe form](/algemene-vormgeving-en-instellingen-van-het-ingebedde-aanmeldformulier) | Yes, by default | Nothing | | Laposta WordPress plugins | Yes, in the latest version | Update the plugin to the latest version. | | [Plain HTML](/kan-ik-helemaal-zelf-een-aanmeldformulier-vormgeven-optie-3) on your own website | Yes, if the `validate.js` script remains in place | Leave the line with `validate.js` and the hidden check field in place when editing the HTML. If you have older HTML on your site, copy the code from Laposta again. | | Custom form via the API | On request | Ask the helpdesk via [helpdesk@laposta.nl](mailto:helpdesk@laposta.nl) to enable the spam check for your list. | For plain HTML on your own website, the `validate.js` script is important. It retrieves a one-time token, solves a computational puzzle and collects behavioural signals. Without this script, your form has only limited protection. > **Note** > > Laposta deliberately does not use third-party captchas, such as reCAPTCHA. These often require consent under the GDPR and send your visitors' data to another party. You therefore do not need to add one yourself either. ## How does Laposta recognise bots? A bot is often a script that searches for and fills in forms, but increasingly it is a regular browser controlled by a program. That is why Laposta combines a series of checks. A single check is not always enough, but together they stop most bots. * Rate limit: only a limited number of subscriptions per minute and per hour can be submitted from a single IP address or on a single form. In the event of a sudden surge, the extra attempts are ignored. * One-time token: upon submission, the form requests a unique, briefly valid code. This is tied to your account, your list and, where possible, the visitor's network. A simple bot does not request this code or reuses it. * Computational puzzle: along with the token, the browser receives a small puzzle that is solved in a fraction of a second. The visitor does not notice anything, but a bot has to solve it again for every subscription. This makes mass submissions costly. * Browser behaviour: the system checks whether there was genuine interaction, such as touched fields, mouse or touch movements and the speed of submission. Signals indicating an automated browser are also taken into account. * Hidden field: the form contains a field that a human cannot see and therefore does not fill in. If a bot fills it in, the subscription does not count. * Submitted too quickly: a subscription that arrives inhumanly fast after loading is almost always automated. * Blocklists: Laposta maintains lists of abused IP addresses, networks and email domains, including known Tor exit nodes and disposable addresses. The helpdesk can add addresses or domains to these lists. * Email address check: in addition to the standard validity check, the filter looks for patterns commonly associated with spam, such as random-looking addresses. * Country rule, on request: if a list suffers heavily from spam, the helpdesk can block a country or only allow subscriptions from specific countries. ## Are you still experiencing fake subscriptions? If strange addresses are still getting through, please email [helpdesk@laposta.nl](mailto:helpdesk@laposta.nl). Mention which list is affected and which form you are using: plain HTML, embedded, standalone, a plugin or the API. The helpdesk will then look into it with you. ## Related articles #### [Building your own subscribe form with HTML](/kan-ik-helemaal-zelf-een-aanmeldformulier-vormgeven-optie-3) Use Laposta's plain HTML to build your own subscribe form for your website without… #### [What types of subscribe forms are there?](/hoe-kom-ik-aan-een-aanmeldformulier) Choose between a standalone or embedded form, or design your form entirely yourself in… #### [Why do the spam filters of Gmail and Hotmail block your newsletter?](/waarom-worden-nieuwsbrieven-naar-gmail-en-hotmail-eerder-als-spam-gemarkeerd) What requirements Google and Microsoft set for bulk email and how to ensure your… #### [What is double opt-in and when do you use it?](/moet-ik-double-opt-in-gebruiken) Read about the difference between single and double opt-in, how to set this up and why…