User Registration Protection
Sign-up forms are a common abuse target: fake accounts used for spam, promo-abuse, account farming for resale, or as a foothold for later credential-stuffing attacks. This page walks through a recommended Sentinel setup for a registration flow.
What you're defending against
- Bulk fake sign-ups — scripted account creation at volume, often from a small number of IP ranges or data-center hosting.
- Account farming — accounts created for later resale or abuse, often behaving identically to real users at creation time.
- Disposable-email abuse — sign-ups using throwaway addresses to bypass verification.
Recommended configuration
- Enable Adaptive Captcha on the registration form's Security Group — sign-up is a good place for slightly higher default friction than, say, a search box.
- Keep Autopilot on so difficulty adapts if you see a sign-up spike from a bot campaign.
- Enable Threat Intelligence to catch known-bad IP ranges (data-center hosting, open proxies) commonly used for bulk account creation.
- Add a Rate Limiter on the registration endpoint, scoped per IP and per email domain, to cap how many accounts can be created in a given window.
- If your form collects free-text fields (bio, company name, etc.), attach them as a Form so the Classifier can flag spammy content at creation time.
Verifying on your server
Registration still requires the same server-side verification as any other ALTCHA-protected form — see Server Integration. Reject the submission if verification fails before creating the account.
Related
- Login & Auth Protection — protecting the flow that follows registration.
- Security Groups
- Get Started