A fake account costs you twice: once when it is created, and again every time you clean it out. The cheap place to stop it is before the INSERT.
Most signup defences are reactive — email confirmation, CAPTCHA, a manual review queue. All of them let the account exist first. Screening before the write changes the economics: you never pay storage for the row, never send the confirmation email, and your user counts stay honest rather than inflated by accounts that will never be real users. The useful signal at signup is not the email domain alone — anyone can pass a valid one — but whether the client behind the request is a real browser with real behaviour.
php (registration handler)
Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.
Addresses that exist for minutes. Screening on the domain alone catches the common ones but misses the long tail, which is exactly where volume moves when you start blocking.
Direct POSTs to your endpoint, no browser involved. Trivially scriptable and invisible in analytics because they never load your page.
The same person creating accounts to reset a trial, farm credits or produce referral bonuses. This is the one that costs real money.
Bulk accounts used to seed fake reviews, votes or listings, which is a problem for your credibility rather than your infrastructure.
Yes, deliberately. If ZeroBot cannot be reached, or returns an error envelope rather than a verdict, the score reads as 0 and the signup is allowed. Failing closed here would mean a ZeroBot outage stops every new user from signing up.
No. A specific reason ("datacenter IP detected") tells an abuser exactly which signal to change. Show a generic message and put the detail in your logs.
70 is a reasonable starting point for signup, which is a rarer action than a page view and can tolerate being more careful. Watch the blocked list for a week before tightening it.
Free tier, real verdicts, and documentation with a built-in tester.
Get started free →