How can I prevent list bombing?

List bombing is an attack where bots flood your sign-up forms with fake or unwanted email addresses. It can wreck your open rate and get your domain blacklisted. Here is how to spot it and protect yourself.

What is list bombing?

Bots find a weak sign-up form and submit thousands of fake opt-ins, filling your list with addresses which never agreed to hear from you, or do not exist.

How it hurts you

• Hard bounces and spam complaints damage your sender reputation.
• Your open rate drops.
• You are likely to hit spam traps.
• Your domain may be blacklisted or lose reputation, so your emails go to spam or are blocked.

How to spot it

• A sudden, unexpected jump in new subscribers.
• They all came through the same form.
• They arrived in a short window of time.
• Bounces or spam reports spiked in the same window.
• The contacts have random, gibberish first and last names.

How to prevent it

Use both of these:

1. reCAPTCHA: a short check which proves a person, not a bot, is signing up. See How to add a CAPTCHA to a Contact us page and Secure your registration forms with reCAPTCHA.
2. Double opt-in: new subscribers confirm by clicking a link in an email. Unconfirmed addresses stay out. See How to set up double opt-in.

Already hit?

If the attack came through a form on SleepPRO™:

1. Find the form and the time of the attack.
2. Add reCAPTCHA and double opt-in.
3. Find the fake contacts, usually with gibberish names, and remove them. Excluding them is key to recovering your deliverability. See How to manually clean your email list.
4. Contact SleepPRO™ support any time for help.

If the attack came through an inline or popup form embedded on another website:

1. Find the form and the time of the attack.
2. Remove the form from your other website.
3. Embed it again with the Script button, not the Embedded form button. See How to embed a SleepPRO™ form or popup on an external website.
4. Add reCAPTCHA and double opt-in.
5. Find and remove the fake contacts.
6. Keep watching the form.

Another option: duplicate the form in your funnel, delete the original, and use the copy. The copy has new links, so the old ones stop working. See How to move, duplicate and delete a page from a sales funnel. Then embed the new form with the Script button and add reCAPTCHA and double opt-in.