Bot Detection Techniques for SaaS:
Protect Your Free Tier

Free tiers are essential for SaaS growth—they lower the barrier to entry and let users experience your product risk-free. But they also attract bot traffic at scale.

Automated scripts create thousands of fake accounts to abuse your free tier limits, scrape your data, or resell your service. Without proper bot detection, you're paying infrastructure costs for traffic that will never convert.

Why SaaS Free Tiers Attract Bots

Free tiers are low-hanging fruit for attackers:

• No payment verification: No credit card means no friction for bots
• Valuable features: API access, compute credits, or data worth reselling
• Easy automation: Signup forms are simple to script
• Low detection risk: Many SaaS companies don't monitor free tier abuse
• Trial stacking: Bots create multiple accounts to extend free trials indefinitely

The result? Inflated user counts, wasted server resources, and skewed product analytics.

Common Bot Abuse Patterns in SaaS

1. Fake Signups

Bots create thousands of accounts using disposable emails and automated form-filling tools. Goals include:

• Claiming free trial credits repeatedly
• Scraping your product data or API responses
• Inflating competitor metrics (fake user growth)

2. Trial Abuse

Attackers create multiple accounts to bypass trial limits. Common in:

• AI/ML APIs (free inference credits)
• Email marketing tools (free sends per month)
• Storage platforms (free GB allowances)

3. Data Scraping

Bots sign up, access your dashboard, and extract:

• Pricing data (for competitor intelligence)
• API documentation (to clone your service)
• Public user directories or marketplace listings

4. Resource Exhaustion

Free tier limits are designed for humans, not bots. Automated abuse can:

• Consume compute quotas (serverless function calls, API requests)
• Fill storage limits (uploading junk data)
• Trigger rate limits for legitimate users

Detection Technique #1: Email Validation

Disposable email services are the easiest way for bots to create accounts. Validate emails at signup:

IPASIS includes email validation alongside IP intelligence, so you can check both signals in a single API call.

Detection Technique #2: IP Reputation

Most bot signups originate from:

• Datacenter IPs: AWS, DigitalOcean, Hetzner—uncommon for real users
• VPN/Proxy services: Used to create accounts from different "locations"
• Known bot networks: IPs previously flagged for abuse

Real users sign up from residential ISPs. Datacenter IPs are a red flag.

Detection Technique #3: Rate Limiting

Bots work at scale. Humans don't create 100 accounts per hour from the same IP.

Recommended limits:

• Per IP: Max 3 signups per hour
• Per email domain: Max 10 signups per day (catches "john1@domain.com", "john2@domain.com" patterns)
• Per browser fingerprint: Detects incognito mode abuse

Use stricter limits for datacenter IPs and looser limits for trusted residential IPs.

Implementing Bot Detection in Your Signup Flow

Here's a practical example using Next.js and IPASIS:

// app/api/signup/route.ts
import { NextRequest, NextResponse } from 'next/server';

export async function POST(req: NextRequest) {
  const { email, password } = await req.json();
  const clientIP = req.headers.get('x-forwarded-for') || req.ip || 'unknown';
  
  // Check both email and IP in one call
  const checkResponse = await fetch('https://api.ipasis.com/check', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.IPASIS_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      ip: clientIP,
      email: email
    })
  });
  
  const riskData = await checkResponse.json();
  
  // Evaluate risk signals
  const isSuspicious = 
    riskData.trust_score < 60 ||           // Low trust score
    riskData.email.disposable ||           // Temp email service
    riskData.datacenter ||                 // Hosted on cloud provider
    riskData.vpn ||                        // Using VPN/proxy
    riskData.risk_level === 'high';        // IPASIS flagged as high risk
  
  if (isSuspicious) {
    // Option 1: Block immediately
    return NextResponse.json(
      { error: 'Signup not allowed' },
      { status: 403 }
    );
    
    // Option 2: Require email verification + CAPTCHA
    return NextResponse.json({
      requiresVerification: true,
      requiresCaptcha: true
    });
  }
  
  // Proceed with normal signup
  // ... create user account
  
  return NextResponse.json({ success: true });
}

Progressive Friction: Balancing Security and UX

Don't block users outright—add progressive friction based on risk level:

This approach catches 95%+ of bots while minimizing false positives.

Monitoring Free Tier Abuse

Set up alerts to detect anomalies:

• Signup spike: 10x normal signups in 1 hour
• Low activation rate: Accounts created but never used
• Duplicate email patterns: Sequential emails from same domain
• Resource exhaustion: Free tier users hitting limits instantly

Track the conversion funnel: signups → activated → paid. If "signups" spike but "activated" stays flat, you've got a bot problem.

Advanced: Behavioral Signals

Beyond IP and email, track post-signup behavior:

• Immediate API usage: Bots start making requests within seconds
• No dashboard interaction: Real users explore the UI; bots go straight to the API
• Predictable patterns: Same actions at exact intervals (automated scripts)
• High error rates: Bots often trigger validation errors

Use these signals to flag accounts for manual review or apply stricter rate limits.

Case Study: Reducing Fake Signups by 87%

A developer tools SaaS was seeing 2,000 signups/day but only 50 activations. After implementing IPASIS:

• Before: 2,000 signups/day, 2.5% activation rate
• After: 260 signups/day, 19% activation rate
• Result: 87% reduction in bot signups, but same number of real users

By blocking datacenter IPs and disposable emails, they cut infrastructure costs by 60% while improving data quality.

Best Practices for Protecting Your Free Tier

• Validate email + IP together: Single API call with IPASIS
• Apply rate limits per IP and per email domain
• Require email verification for medium-risk signups
• Use CAPTCHA only for high-risk signups (preserve UX)
• Monitor activation rates to detect bot campaigns early
• Log risk scores to tune thresholds over time
• Implement account review for accounts that hit free tier limits immediately

The ROI of Bot Detection

Preventing bot abuse saves money:

• Lower infrastructure costs: Fewer fake accounts = less database/API load
• Better analytics: Clean data improves product decisions
• Higher conversion rates: Real users aren't drowned out by bots in your metrics
• Improved deliverability: Fewer fake emails = better email sender reputation

For most SaaS companies, bot detection pays for itself within the first month.