Detect and manage suspicious leads

Last reviewed: 2026-09-23

Open the campaign’s Leads screen and select Protection. These settings apply to every signup source in the campaign. Review them before a public giveaway or referral launch, then test a normal signup and referral.

Signup protection

Choose a Duplicate IP policy, from one lead per IP through a limited number or unrestricted duplicates. Shared offices, schools, and households can have one public IP, so choose the policy that fits your audience. Add trusted addresses to Approved IP addresses if needed. The screen also offers a duplicate-IP warning email and an option to apply duplicate-IP checks to API signups.

Turn on Enable invisible captcha if appropriate; the UI says published pages and compatible AnyForm scripts are redeployed when it changes. Reject likely bots before creating a lead stops those submissions before they count toward the monthly lead limit.

Review and delivery

Choose whether opted-out or flagged leads should be excluded from public counts. Add referral-domain or email-domain blocklist entries for sources you know you do not want. Decide whether flagged leads should be sent to integrations; the UI labels that option Not recommended and still avoids sending campaign email to those leads. Select Save lead protection after reviewing the combined policy.

Use the Flagged audience under Leads to find leads for review. Open a lead profile to inspect signup context, status, and available manual actions. A signal is a reason to review, not proof of abuse. See the manual review checklist.

Need help? Email support@kickofflabs.com with the campaign URL, an example lead email, and the protection result you expected.