Big prizes attract people who try to play many times, and bots that try to sign up automatically. Scratcher protects every campaign in the background, and you can add more protection when you need it.
Protection that runs in the background
These protections are always on. Real players don't notice them.
- Every visit is checked. When someone opens your campaign, Scratcher looks at signs that the visit is automated rather than a real person, for example where the traffic comes from and whether many similar visits arrive in a short time. Search engines, link previews and other known crawlers are recognised too.
- Automated visits are filtered out. Visits that look automated can't sign up, and they don't count in your statistics. This keeps both your leads and your numbers clean.
- A captcha appears when it is needed. If the form has the Captcha add-on, Scratcher shows the captcha only to visitors with signs of unusual activity. Everyone else signs up without it.
- Email addresses are checked. Addresses must be written correctly, and throwaway email addresses from disposable email services are blocked. Scratcher keeps this list up to date automatically as new services appear. Blocked addresses are recognised even when they are written slightly differently.
- One person, one limit. The participation limit follows the unique field, usually the email address or phone number, so the same person can't play more than you allow. See Limit how often people can play.
People who are stopped see a general error message that doesn't explain why. You can change its text under Custom error messages in Settings > Participation.
Good to know: we don't publish the details of how the background checks work, because that would help people get around them. If you think real players are being stopped, or cheaters are getting through, contact us and we'll look at your campaign.
Captcha
Turn on the Captcha add-on on the form to stop bots. By default the captcha only appears when needed (see above). Choose Always show captcha if you want everyone to complete it, for example for a very valuable prize. See Every form add-on.
Block emails, domains and IP addresses
- Open Settings > Security in the editor and click Disallow list.
- Under Email, Email domain or IP, click Add item and type the address, the domain (for example
example.com) or the IP address. - Add up to 20 items in each list.
Blocked people see the general error and can't take part. A blocked IP address can't open the campaign at all.
Rate limit
Turn on Rate limit in Settings > Security to limit how often the same participant can perform actions in the campaign. It slows down people and tools that try to sign up again and again.
Protect the preview
Set a Password for preview access in Settings > Security, so only people with the code can see the preview before launch.
Double opt-in
Double opt-in makes sure every email address is real and belongs to the person who signed up. See Set up double opt-in.
Check your winners
Before you hand out a big prize, look at the winner on the Leads page: when they signed up, how often they played and from which IP address. Several winners with almost identical details are worth a closer look.