Bots are signing up to your Klaviyo list: how to stop them and stop paying for them

Why are bots signing up to my Klaviyo list?

Klaviyo calls it list bombing: an attacker makes a large number of fake submissions through a signup form or checkout page (Klaviyo Help Center). Klaviyo lists the usual targets:

• Ecommerce checkouts: a bot starts a Shopify checkout with a real person's email and abandons it, and the event syncs to Klaviyo.
• Footer signup forms that ask only for an email.
• Discount-code popups, which bots farm for coupon sites.
• Any form without a CAPTCHA, and third-party forms synced through Klaviyo's API.

What do bot signups cost me?

• Deliverability. Sending to bot profiles brings hard bounces, spam complaints, lower open rates and possible blocklisting (source).
• Your Klaviyo bill. Klaviyo's pricing tiers are based on active profiles, so every bot profile that stays active counts (source).
• Real people's inboxes. Bots often use real, stolen emails. Those people never asked for your emails, and they mark them as spam.

How do I spot a list-bombing attack in Klaviyo?

Look for a sudden spike in subscribers you can't tie to a campaign. Klaviyo suggests checking whether the new profiles came through one form, in one time window, from one email domain or one IP address, or with unusual names (source).

How do I remove fake profiles from Klaviyo?

1. Build a segment that matches the attack: the form, the date range, the domain, or profiles that can receive email but never opened or clicked and never ordered.
2. Review a sample by hand. Bots can use real people's emails, but real subscribers can match too.
3. Suppress the segment rather than only removing it from a list. Suppressed profiles can't receive your emails, and Klaviyo doesn't charge for them (source).
4. If the same people also became Shopify customers, delete those customers in Shopify after suppressing them, so you can still match them by email.

How do I stop bots from signing up again?

• Double opt-in. Only people who confirm get added to the list. It's on by default in Klaviyo, and Klaviyo recommends turning it back on after an attack (source).
• CAPTCHA. Klaviyo forms show one automatically when a submitter looks suspicious (source). On Shopify, keep hCaptcha on for your theme's newsletter forms (source).
• A honeypot field on custom forms: a hidden field real people never fill in. A developer adds it, and you suppress any profile that has it set.
• Stop bot checkouts. If the profiles come from abandoned checkouts, see how to stop card testing.

How does Linesman handle Klaviyo bot signups?

Connect Klaviyo with a private API key (Pro). Linesman then checks new Klaviyo profiles every 15 minutes, lists the bot-looking ones with the reason, and lets you suppress them all at once or keep any that are real people.

• With auto-clean on, bot profiles are suppressed 24 hours after signup, after a second check. Profiles that became customers in the meantime are skipped.
• When you delete bot customers in Linesman, it suppresses them in Klaviyo first. If that fails, nothing is deleted.
• Savings shown in Linesman are estimates from your next Klaviyo bill, never a refund.

Frequently asked questions