Stop bot and scripted sign-ups
To stop bot sign-ups you have to look past the form itself, because a script can fill in a form as neatly as a person. InlineShield checks each registration for the marks automation leaves behind: a headless browser, an automation framework, an HTTP library posting straight to your server, or an email address no human would choose.
Last updated
What bot farms look like at registration
Bonus farms rarely sign up by hand. They run a headless browser or a short script that opens accounts in a loop, each with a fresh address and the same welcome offer at the end of it.
A CAPTCHA slows some of them down. It does not tell you that the "player" who solved it is the fortieth account from the same script today, and it adds friction for every honest player too.
Signals InlineShield checks
Headless browsers and automation frameworks
Scripted HTTP clients
Machine-made email addresses
[email protected] are typical of generated accounts. InlineShield scores how random the part before the @ looks.Skipping the browser check
Why the check runs on your server
A browser-only check can be skipped by anyone who posts to your registration endpoint directly. InlineShield's browser script collects its signals and hands your form a token, and your server then asks InlineShield for the verdict with /api/v1/siteverify before creating the account.
If the token is missing, the ready-made snippets fall back to a server-only check with /api/v1/verify, using the visitor's IP and User-Agent from your own request. Either way, the decision is made on your side of the wire. The API page shows the code, and pricing shows the plan limits.
None of this uses device fingerprinting. InlineShield does not build a profile of the player's device to follow them around.
Frequently asked questions
Do I still need a CAPTCHA?
That is up to you. InlineShield does not need one, and it catches things a CAPTCHA cannot see, such as a scripted client or a machine-made address. Some sites keep both.
Will this block players on unusual browsers?
An unusual browser is not a bot signal by itself. The checks look for automation: headless signatures, automation hints and the default User-Agents of scripting libraries.
What if the browser script is blocked by an ad blocker?
Your server gets no token and can check the sign-up server-side with /api/v1/verify instead, using the visitor's IP and User-Agent. If you prefer, you can refuse sign-ups without a token.
Does InlineShield fingerprint devices?
No. It reads the signals of a single sign-up and does not build or store device fingerprints.
Can a bot sign-up be held instead of blocked?
Yes. Depending on the signals, a sign-up can be blocked outright, held for review, or allowed without the welcome bonus. See risk verdicts.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.