Free · BurrowGuard
Keep bots out of your sign-up forms.
Check every email before it becomes an account. Add a small script and one tag. Real visitors never solve a puzzle, and your server gets a clear pass or block.
Free with a Groundmail account. No card to sign up.
How it works. Three steps, no puzzles.
A small script and a <burrow-guard> tag next to the email field.
Your visitor’s browser solves a small proof-of-work in the background, in about a second.
Send the token and email to POST /burrowguard/verify. Accept if success is true. Tokens work once, for one email, for 5 minutes.
What it checks. All in one call, before the account exists.
Wrong format, or a domain with no mail server.
Throwaway inboxes that vanish after the sign-up.
Addresses that have bounced on Groundmail.
Dot-stuffed Gmail addresses and gibberish.
Automated browsers, and forms filled too fast for a person.
Networks with a record of abuse, and Tor exits.
Optional, for B2B forms that only want work addresses.
Visitors get your form’s own message. Every reason is in your dashboard.
Two snippets. That’s the install.
<script src="https://api.groundmail.dev/burrowguard/v1/burrowguard.js"
async></script>
<form action="/signup" method="post">
<input type="email" name="email" required>
<burrow-guard site-key="YOUR_SITE_KEY">
</burrow-guard>
<button>Create account</button>
</form>const check = await fetch('https://api.groundmail.dev/burrowguard/verify', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.GROUNDMAIL_BURROWGUARD_SECRET}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ token, email }),
})
const { success, reason } = await check.json()
if (!success && reason !== 'no_token') return showFormError()We never store the address. Only the email’s domain and a one-way hash.
Already using a captcha? Use email checks only: one server call, no box.
Questions
Is BurrowGuard really free?
Yes. You need a Groundmail account, and there’s no card to sign up. It covers 50,000 checks a month per account. Past that your forms keep working, but sign-ups pass unchecked until the next month.
Will real visitors have to solve a puzzle?
No. Their browser does the work in the background while they fill in the form. They see a small box that says Checking, then Verified once the email passes, or nothing but a “Protected by Groundmail” line if you choose invisible mode. If the script can’t run, for example because it’s blocked, the form still submits, and your server is told there was no token.
What does a blocked visitor see?
If the email fails, the box says Couldn’t verify and asks them to try another one. If they submit anyway, your server gets the result and you show your own message. They never see the reason, so a bot learns nothing from it.
What if a real person gets blocked?
It can happen. These are signals, not proof: someone on a cloud VPN looks like a data center, and an unusual address can look like a bot’s. Every block and its reason is in your dashboard. Turn on Allow data-center IPs if your audience uses them, and put a way to reach you in your form’s error message.
Can I block free webmail on a B2B form?
Yes. Turn on Block free webmail for that site, and Gmail, Outlook and other personal addresses are turned away. It’s off by default, and it’s set per site, so your other forms aren’t affected.
Keep fake sign-ups off your list.
Fewer bad addresses means fewer bounces when your app sends its first email. Create a site key and add the tag.