GUIDE

Something is hammering your app

You wake up and your signup table has hundreds of new rows from overnight. None of them look like real people. Your email sending cost or AI usage bill might already be climbing. This is a bot attack, and it's more common than most people realize. Here's how to stop it and clean up without deleting anyone real.

Stop the bleeding first

Do these in order, right now, before you touch the database:

Turn on your host's bot protection. Most hosts (Vercel, Netlify, Cloudflare) have a setting for this. It's usually off by default. Turn it on for your signup and API routes.
Add a captcha to your signup form. Cloudflare Turnstile is free and takes one afternoon to add with AI help. This alone stops most bots.
Rate-limit the signup endpoint. Rate limiting means blocking an IP address after too many requests in a short time. Ask your AI to add a limit like "5 signups per IP per hour."
Cap spend on any AI or email key tied to signup. Go to your OpenAI, Anthropic, Resend, or SendGrid dashboard right now and set a hard spending limit. This is the step that actually stops your bill from climbing while you fix everything else.

Find the junk rows without deleting real users

Fake signups usually share patterns: emails from the same domain, signups seconds apart, no follow-up activity, obviously random usernames. Before deleting anything, look at the data with your AI and ask it to show you the pattern, not delete rows.

I have hundreds of suspicious signup rows in my database from overnight. Show me a query that lists the signups from the last 24 hours, grouped by email domain and signup time, so I can see the pattern. Do NOT delete or modify anything yet. Do NOT write a delete query until I confirm the pattern with you. Explain what makes each group look real or fake before suggesting what to remove.

Once you see the pattern, back up the table before deleting anything. Ask your AI to export the rows you're about to remove to a CSV first, so you have a record if you're wrong about one.

Before deleting any rows, first export the exact rows you plan to delete to a CSV file so I have a backup. Then show me the delete query and explain in plain English what it will remove and why. Do NOT run the delete until I say "confirmed." Do NOT touch any row with real activity like a login or purchase, even if the email looks strange.

Why this happens

Bots scan the internet constantly for open signup forms and public API endpoints with no protection. If your form just takes an email and writes to a database with nothing checking who's asking, it's an easy, free target. This is automated scanning, not a person targeting you specifically, and it can find unprotected forms the same day they go live. This is one of the most common problems for people who launch with AI tools like Bolt, Lovable, or Cursor, because those tools focus on getting a feature working, not on locking down who can call it.

The honest limit

Captcha, rate limits, and bot protection stop almost all automated attacks. They will not stop someone determined enough to hire a developer or write custom code to get around them. If you see a second wave after fixing all four steps above, you're dealing with a targeted attacker, not a random bot, and that's a different problem that usually needs a developer's help. For most people, the steps above are enough, and anything beyond that is diminishing returns unless you're seeing real, repeated targeted abuse.

What to check before you relax

Check	Why it matters
Spending caps are set on every key	Stops surprise bills even if bots come back
Captcha shows on the live signup form	Confirms the fix is actually live, not just saved
Old junk rows are gone	Keeps your stats and emails accurate
You have a backup from before deleting	Lets you undo if you removed something real

Plyo backs up your database automatically and runs a health check after each publish, so a mistake during cleanup is easier to undo. Whatever tool you use, the real fix is the four steps above, done today, not next week.

Plyo is the home for AI-built projects: every version saved, one click to undo, one click to publish, plus a safety check, visitor counts and backups. Free to start: 3 projects, no card needed.

Give your project a home