Protect email signup forms from spam and bots

These controls can work together. Someone can manually enter a disposable address, and a bot can submit a real person’s email. Confirming an address also does not guarantee that its owner will read your future campaigns.

Risky email filtering and reCAPTCHA are Pro features. Double opt-in is available without those Pro controls. Check the current plan details when choosing your setup.

Filter risky email addresses

Under Filter risky emails, you can enable two filters separately. Choose them according to the addresses you want to accept, rather than treating every unfamiliar email domain as spam.

Filter disposable emails

Enable Filter disposable emails to block addresses classified as temporary or throwaway. This is useful for a signup offer where someone can collect a coupon with a short-lived inbox and never receive your next campaign.

For example, a store offering a first-order discount may want a lasting contact address. Double opt-in alone does not solve that problem because a temporary inbox can still receive and confirm an email. Disposable email filtering addresses that specific gap.

Filter untrusted emails

Enable Filter untrusted emails to block addresses classified as untrusted. This category can include masked, relay, invalid, or unclear email sources with low reliability.

Use this filter thoughtfully if your audience relies on privacy-focused email services. A risk classification is a signal about the address, not proof of malicious intent. If a customer reports being unable to subscribe, check which filters are enabled before assuming they entered their address incorrectly.

Set up double opt-in

Double opt-in adds an email confirmation step. A visitor submits the form, receives a confirmation email, and clicks its link to complete the subscription. In Getsitecontrol’s double opt-in flow, respondents who have not confirmed are not added to the contact base through that signup.

This helps when someone mistypes their address or enters an address they do not control. It also introduces a step that genuine subscribers may miss, so the form’s success message and the confirmation email should make the next action obvious.

Create or select a confirmation email

In Anti-Spam, find Double opt-in email. Choose an existing confirmation email or click Create new. You can edit the subject, sender, title, message, and button text. The sender can use a shared Getsitecontrol domain or your own configured sender domain.

Use a sender name visitors will recognize from the form. A person signing up for a store’s newsletter should immediately understand why that store is asking them to confirm their address.

Make the confirmation request clear

Keep the email focused on confirmation. For a fictional store called North Studio, the following copy connects the message to the signup without turning it into a promotional campaign.

On the form’s post-submission page, use a message such as “Check your inbox for a confirmation email from North Studio. Click the link to finish signing up.” A generic “You’re subscribed” message would suggest the process is already complete.

Choose what happens after confirmation

Use Built-in success page to customize the confirmation page’s title and text. Choose My own landing page if you want the confirmation link to lead to a page on your website instead.

For a newsletter, a simple confirmation page can explain what readers will receive next. For a downloadable guide, a dedicated landing page can provide the promised resource after confirmation. Check that the destination matches the offer in the original form.

Reuse an email across related widgets

One confirmation email can be linked to several widgets. For example, a newsletter popup and an inline form at the end of a blog post can use the same confirmation message. Create separate messages when the language, brand, or signup promise differs.

Manage double opt-in emails lets you review the messages and the widgets using them. Before editing a shared confirmation email, check its linked widgets so the new wording still makes sense for every signup source.

Enable Google reCAPTCHA to reduce bot submissions

Getsitecontrol uses invisible reCAPTCHA v3 to help protect email signup forms from automated abuse. It evaluates interactions in the background without asking visitors to solve an image puzzle. Google describes how its scoring works in the reCAPTCHA v3 documentation.

In the widget’s Anti-Spam tab, enable Defend forms against spam, fraud and abuse. Getsitecontrol handles the integration, so you do not need to create a Google account or paste your own reCAPTCHA keys into the editor. Save the widget after configuring it.

Combine bot protection with email confirmation

Double opt-in requires a confirmation email to be sent. If a bot repeatedly submits other people’s addresses, those recipients may receive unwanted confirmation requests even if they never join your mailing list.

reCAPTCHA helps reduce that automated activity at the form. Double opt-in then checks the recipient’s confirmation. Neither is a promise that every abusive signup will be caught, but they address different parts of the problem.

Keep the badge or use the provided notice

The editor includes Hide the reCAPTCHA badge. If you enable it, follow the notice instructions shown in the editor and display the supplied attribution with its Google Privacy Policy and Terms of Service links. Hiding the badge does not disable the protection.

Choose a setup for your signup offer

The right combination depends on what happens after someone submits the form. Consider both the quality of the address and the emails or resources the signup will trigger.

A newsletter receiving a sudden burst of signups

Enable reCAPTCHA to help reduce automated submissions and connect a double opt-in email to confirm recipients. Check every active signup form, including inline forms that may be easy to overlook. Look for confirmed contacts as well as raw submission numbers when assessing whether the new traffic is useful.

A discount popup attracting throwaway addresses

Enable disposable email filtering and consider double opt-in if you want email ownership confirmed. Decide when the discount should be delivered. If a coupon is displayed immediately on the form’s success page, email confirmation will not prevent the visitor from seeing it first.

A guide download that should lead to ongoing emails

Explain on the signup form what the visitor is subscribing to, then use a confirmation email that repeats that expectation. Point the confirmation success page to the guide if access should follow confirmation. Test the full path from form submission to download so an interested reader does not get stuck between the two.

Several forms in different languages

Configure protection on each widget and connect a confirmation email in the corresponding language. A visitor using a French signup form should receive a French confirmation request and arrive at a matching success page. Shared confirmation emails are useful when the forms make the same promise in the same language.

Test your signup flow before publishing

Run a signup on your website using an email address you control. Check the form’s success message, the confirmation email, and the page reached after clicking its button. The confirmation editor also includes a test-email option for reviewing the message before you try the complete flow.

A subscriber cannot find the confirmation email

Check the spelling of the submitted address and ask them to look in their spam folder. Review the sender name and subject so the message is recognizable. If you edited or replaced the confirmation email, check that the widget still has the intended message linked to it.

A real visitor cannot submit the form

Review the enabled email filters and the address category. Test in a normal browser session with required scripts allowed to load. If the problem continues, share the widget and the steps that reproduce it with support so the cause can be investigated.

Signups look successful but the list is not growing

With double opt-in, submitting the form and confirming the subscription are separate actions. Test both. Review the confirmation message and its linked widgets, then check the contact record after confirming. If you also send contacts to another platform, test that integration separately rather than assuming a successful form submission proves the entire route worked.

You already have suspicious contacts

These settings protect new form signups. They do not replace reviewing an existing list or checking other sources such as imports and connected apps. Investigate where unwanted contacts came from before changing the popup’s protection settings.