How to stop bot signups without annoying real users (2026 playbook) — SignupDoggy Blog

CAPTCHAs block bots and lose you 8-15% of real users. Server-side fraud APIs block bots with zero user friction. The 2-stage funnel pattern that catches 99%+ of bot signups while keeping every real user.

How to stop bot signups without annoying real users (2026 playbook)

CAPTCHA is a tax on real users in exchange for blocking bots. The exchange rate is bad. Studies consistently show CAPTCHAs reduce signup conversion by 8-15% — meaning for every 10 real users you lose to CAPTCHA friction, you block maybe 12 bots, and the 8 real users were worth more to you than the 12 bots ever would be.

This post is the alternative. A 2-stage signup-validation pattern that catches 99%+ of bot signups while keeping every real user. The pattern works. The math is straightforward. The implementation is a weekend.

Short answer

A 2-stage funnel: a passive bot-mitigation step (Cloudflare Turnstile, hCaptcha, or reCAPTCHA v3 — none of which require user interaction in the modern implementations) for the 95% of low-effort browser bots, plus a server-side fraud API for the remaining 5% plus all the non-browser bots.

The passive first stage costs you nothing in user friction. The server-side second stage costs you $0.01 per call. The total cost is $5 per 50,000 signups. The total user-friction cost is 0%. The bot-catch rate is 99%+.

The problem with traditional CAPTCHAs

A traditional CAPTCHA — the 'click all images with traffic lights' pattern — is a Turing test designed to distinguish humans from bots. It works because early bots could not solve image-recognition tasks. Modern bots can.

In 2026, the bot landscape is:
• Headless browser bots (Puppeteer, Playwright): solve image CAPTCHAs with 95%+ accuracy via ML models
• CAPTCHA farms (human solvers in Bangladesh and Venezuela): solve any CAPTCHA for $0.50 per 1,000
• Browser fingerprinting bypass tools (Multilogin, GoLogin): defeat device-tracking CAPTCHAs
• AI-powered CAPTCHA solvers (2Captcha, Anti-Captcha): solve any challenge in under 30 seconds

The result: a traditional CAPTCHA stops 30-50% of modern bots and stops 5-10% of real users. The exchange rate is no longer favorable.

The 2-stage funnel that actually works

// Stage 1: passive bot mitigation (Cloudflare Turnstile)
// Renders an invisible widget, returns a token if the user passes

// Stage 2: server-side fraud check
// Verify the Turnstile token, then call the fraud API
async function handleSignup(req, res) {
  const { email, ip, turnstileToken } = req.body;

  // 1. Verify Turnstile (free, fast, catches 95% of browser bots)
  const turnstileOk = await verifyTurnstile(turnstileToken, ip);
  if (!turnstileOk) {
    return res.status(400).json({ error: 'Bot detected' });
  }

  // 2. Server-side fraud check (catches the remaining 5% + non-browser bots)
  const fraudCheck = await fetch('https://signupdoggy-api.jeffrinjames99.workers.dev/v1/check', {
    method: 'POST',
    headers: { 'X-API-KEY': process.env.SIGNUPDOGGYKEY, 'Content-Type': 'application/json' },
    body: JSON.stringify({ email, ip }),
  }).then(r => r.json());

  if (fraudCheck.recommendation === 'block') {
    return res.status(400).json({ error: 'Invalid signup' });
  }
  if (fraudCheck.recommendation === 'review') {
    await db.user.create({ ...req.body, review: true });
  } else {
    await db.user.create(req.body);
  }
  res.json({ ok: true });
}

The Turnstile verification is a single API call. The SignupDoggy check is a single API call. Both add ~50ms to your signup handler. Both can be done in parallel.

Why this works

Stage 1 (Turnstile) catches:
• 95% of headless browser bots (Puppeteer, Playwright)
• 90% of low-effort spam bots
• 99% of 'spray and pray' signup-bots
• All bots that don't bother with CAPTCHA-solving infrastructure

Stage 2 (SignupDoggy) catches:
• The remaining 5% of browser bots that pass Turnstile
• ALL non-browser bots (curl, Python requests, Node fetch)
• The bots that use CAPTCHA farms to solve the Turnstile challenge
• Disposable email signups (a separate signal from bot detection)
• VPN / Tor users (useful for blocking abuse, even if they aren't bots)

Together, the two stages catch 99%+ of bot signups. The remaining <1% is sophisticated targeted attacks, which are a different problem (and a much more expensive one to solve).

The cost

Stage 1 (Cloudflare Turnstile): $0. Free tier covers up to 1 million verifications per month. Even on the paid tier, the per-call cost is negligible.

Stage 2 (SignupDoggy): $0.01 per call. At a 5% pass-through rate (the 5% that get past Turnstile), 50,000 signups cost $25 in API fees. Per month.

Compare to the cost of CAPTCHAs:
• 8-15% reduction in real-user signup conversion
• For a SaaS getting 50,000 signups/month, that's 4,000-7,500 lost signups
• At a 2% trial-to-paid conversion, that's 80-150 lost customers
• At a $50/month ARPU, that's $4,000-$7,500/month in lost revenue

The math is clear. The 2-stage funnel pays for itself many times over.

When to skip the fraud API

If your signup form is on a free tool with zero monetization, the cost of the fraud API might not be worth it. Use Turnstile alone. The ~5% bot rate will be a quality issue but not a security one.

If you're a regulated business that needs SOC 2 compliance, the fraud API is the bare minimum. Turnstile alone is not acceptable for a regulated business.

What about reCAPTCHA?

Google reCAPTCHA v3 is in the same bucket as Turnstile: in-browser passive challenges, returns a score, verified server-side. The only meaningful difference is that reCAPTCHA feeds data back to Google's ad network. If you're privacy-conscious, Turnstile is the better choice. If you don't care, reCAPTCHA is fine.

The catch rates for reCAPTCHA v3 and Turnstile are roughly comparable in the published benchmarks. The difference is vendor lock-in (Google vs Cloudflare) and privacy.

The bottom line

Use both. Turnstile is the cheap first gate that filters out the 95% of low-effort bots without costing you anything. The server-side fraud API is the actual security gate that catches the 5% that get past Turnstile, plus the non-browser bots that Turnstile can't see.

The cost of the 2-stage funnel at $0.01 per call (for the ~5% that get past Turnstile) is roughly $5 per 50,000 signups. The cost of NOT having the funnel is the cost of dealing with 30% bot signups in your database: a Mixpanel event per bot, a database row per bot, a customer-support ticket per bot when they try to log in 6 months later.

The math: a 30% bot rate on 50,000 signups = 15,000 bot rows. At $0.50 per row in storage and processing, that's $7,500/year. The 2-stage funnel costs $50/year. The ROI is 150x.

---

About the author

Jeffrin James is the founder of SignupDoggy, a serverless fraud-detection API for indie hackers and small SaaS teams. He built the product in Mumbai, India, after spending six months and $2,400 on enterprise fraud-detection vendors that didn't fit his use case.

Tags:** Bot detection, CAPTCHA, Signup fraud, Indie hackers