Community abuse
How to reduce automated poll and vote manipulation
Protect the meaning of a vote with eligibility and uniqueness rules, while using verification and rate controls as supporting conditions.
By the easycaptcha team · Published
A poll can intend one vote per account, one per verified participant, or something else entirely. Define that rule before adding a CAPTCHA. Without an eligibility and uniqueness model, a solved challenge does not tell the application whether the same permitted actor already voted.
Voting rules
OWASP’s skewing definition identifies manipulation of metrics and outcomes through repeated activity. Your application’s policy must establish what counts as a legitimate contribution.
Enforce rules on the write operation
Review browser, mobile, and direct API voting routes. Require authentication and eligibility as appropriate, and record the vote in a way that handles simultaneous requests. Hiding a button after a click is useful UI behavior but not a uniqueness constraint.
If verification is required, validate its result on the server before accepting the vote. Keep that condition distinct from permission to participate and whether an actor has already contributed.
Preserve useful participation
Visitors can abandon a vote because the challenge is confusing, an error loses their selected option, or a shared network triggers a broad limit. Review those paths instead of interpreting every decrease in voting as a reduction in manipulation.
Make error messages explain the next allowed action without exposing internal detection rules. Ensure keyboard and screen-reader users can inspect their choice, complete verification, and receive confirmation.
Investigate outcome patterns
Compare attempted votes, accepted votes, unique eligible participants, and reversals or moderation decisions. Record the operation stage and appropriate identifiers while limiting unnecessary personal data.
A CAPTCHA can help control automation volume, but it is not a voting-integrity system. Read fake-account prevention for account-based participation and rate-control design for complementary limits around the actual write operation.
Frequently asked questions
Does CAPTCHA enforce one vote per person?
No. Your application must define voting eligibility and duplicate-vote rules. A completed challenge does not establish a unique person.
What should a poll count as a successful submission?
Count accepted votes under the poll's rules. Keep challenge completion separate from whether the server accepted the vote.
Can I try easycaptcha browser assistance for free?
Yes. Install the Chromium extension and activate its free plan for 25 recognitions a day, without an account or credit. Larger or multi-round challenges can use multiple recognition groups.