Limit sign-ups from shared infrastructure

Bulk sign-up attacks often run on shared infrastructure. The fake accounts look unrelated to each other and can come from many IP addresses, but the same infrastructure is behind them. This protection looks for sign-ups that match this pattern and blocks further ones once they reach your hourly limit. Sign-ups from widely used services that Clerk recognizes, such as Gmail and Outlook.com, aren't counted.

What happens when the limit is reached

Once the count for the past hour reaches your limit, Protect blocks further sign-ups that appear to use the same infrastructure until the count drops below the limit. The user sees a message that they can't sign up. See What blocked users see.

Blocked sign-ups also count toward the limit. Clerk records each one as a protect.sign_up.blocked event in Application Logs.

Settings

Choose a limit

The default leaves room for ordinary bursts of sign-ups from unrelated organizations that happen to share infrastructure. If your users often sign up in large groups, set it higher. A real person who reaches the limit can't sign up until the count drops below it, so when in doubt, set the limit higher rather than lower. Review blocked sign-ups in Application Logs before you lower it.

How it works with other protections

Limit sign-ups per IP address caps sign-ups from one IP address. This limit applies across IP addresses. Protect's sign-up limits each count sign-ups in a different way, so an attack that stays under one limit can still reach another. See Available protections.

Before you enable it

• Real people can share infrastructure with an attack. While an attack pushes the count over the limit, Protect blocks those people's sign-ups too. Watch the protect.sign_up.blocked events after you turn it on, and raise the limit if real users are among them.
• Check your automated tests. Tests that create many accounts can reach the limit. Protect doesn't count sign-ups with a valid Testing Token.