Attack of the Bots: Why You Need reCAPTCHA

Are you using reCAPTCHA on your site’s forms? If not, you’re taking a major risk. reCAPTCHA helps protect one of your most valuable assets: your domain reputation. If I could tell every one of our customers to implement reCAPTCHA today, I would!

Some marketers worry it will require too many resources or frustrate their users. However, the truth is that reCAPTCHA presents very few barriers — and the benefit of protecting your domain’s reputation is priceless. 

When bots attack: a cautionary tale

Here’s a real-world example that illustrates how skipping reCAPTCHA can cost you. Company X (not their real name, of course) had an automated workflow set up for their emails, but no reCAPTCHA on any of their forms.

One night, a bot poured junk emails into one of their forms — hundreds of thousands of addresses. The automated workflow did exactly what it was supposed to do: sent Company X’s automated emails to all the junk addresses. 

Since most of the emails were fake or spam traps, the majority of the messages bounced or were sent straight to spam. The result: a low domain reputation with Google Postmaster Tools. That meant all the emails they were sending to real customers began landing directly in the spam folder.

Eventually, they got their good reputation back, but it took a long time — and damaged their sales as they tried to rebuild.

The case for reCAPTCHA

As the case of Company X demonstrates, the cost of a bot attack can be huge. If they’d had reCAPTCHA in place, they could have been better protected. 

Your domain reputation is your most valuable asset

Without a strong domain reputation, you’re cut off from communicating with your customers. All the revenue you gain from email marketing instantly dries up until you recover.

In the case of Company X, it took months to rebuild their domain’s reputation. reCAPTCHA could  have prevented the crisis — perhaps a few junk addresses would have gotten into their workflow, but that’s a relatively minor problem. Bottom line: if a bot attack tanks your domain reputation, you will lose money. 

Rehabilitating your domain is costly

Restoring a domain’s reputation takes weeks or months. And while you’re rebuilding, you’ll be losing sales and working double-time to rebuild existing customer relationships. 

At the same time, fixing your domain security eats up considerable resources. For instance, Company X had to build segments of highly engaged recipients for very small sends — 200 or 500 at a time — then slowly scale back up. It’s a painful process, especially if your email list is in the hundreds of thousands.

Overcoming barriers to reCAPTCHA

The two biggest concerns I hear from marketers are that reCAPTCHA creates a bad customer experience and that implementing it requires too many resources. However, I’d argue that these worries are not worth the risk of compromising your domain reputation.

Your customers expect reCAPTCHA

It’s true that reCAPTCHA adds an extra step for customers, but in my experience, it doesn’t create a barrier to engagement. These days, it’s a standard practice, and people are accustomed to it. In fact, it’s far less intrusive than other common practices, like pop-ups. 

The benefits outweigh the costs

If you have highly customizable forms, it may take extra time and resources to implement reCAPTCHA. I advise customers to think bigger-picture. The resources required to implement reCAPTCHA pale in comparison to the cost of rebuilding your domain reputation. Think of it as an investment in protecting a critical business asset. 

What to do if reCAPTCHA isn’t an option

Most platforms support reCAPTCHA, so if you have it, use it! If it’s not available on your platform, find another protective strategy.  

For instance, if you have custom forms, you can add a line of HTML that helps weed out bots. Another option is an email validator service, which checks incoming email addresses and sends only valid ones to Customer.io. While these approaches might add extra cost or steps to your workflow, the security of your domain reputation is worth it. 

When you can skip reCAPTCHA

For forms behind a sign-in or paywall, reCAPTCHA is not needed. Only those available to anyone are vulnerable, like sign-in, contact, and newsletter sign-up forms. 

Also, if you’re a solopreneur, bots aren’t likely to target your business, so reCAPTCHA is less crucial. That said, it’s still worth considering as a best practice — imagine the headache of sorting through a load of junk, even if it’s just a small attack.

An ounce of prevention saves you a world of pain

Unfortunately, the internet is full of bad actors. When Company X was attacked, they kept asking themselves, “Why us? What did the bot get out of this?” Causing havoc is often the sole motivation for these kinds of attacks — and the company suffered the consequences. 
Bot attacks are entirely unpredictable. You can’t know if or when you’ll be targeted, but you can protect yourself. Adding reCAPTCHA to your forms protects your business so you can focus on building great products and improving your customers’ experiences.