Fake-signup & free-trial abuse protection for SaaS
One script tag on your signup form. Vetto blocks disposable and dead emails, catches the trial abuser's 7th Gmail alias and stops bot bursts, and turns [email protected] into a one-click fix so real users still get in.
Founding offerPro for life, $69 once. First 100 buyers, until Nov 27.
<script src="https://usevetto.com/v.js" data-site="pk_xxxxxxxxxxxxxxxxxxxx" defer></script>Free on 1 site · no card · Next.js, Supabase, Webflow, Framer, WordPress · fails open after 800 ms
This week on your site
Demo$0.00
saved: rescued × $29 + blocked × $0.50
6.2×
Stripe saw 6.2× more abusive free trials between Nov 2025 and Feb 2026.
~10%
~10% of new registrants typed their email wrong or left it missing.
gmai.com
gmai.com has a live mail server — MX-only checks let it through.
What Vetto catches
Each signal maps to an action you choose: allow, flag, suggest, warn or block. Pro signals run in shadow mode on Free, so you see what you'd catch.
Asks “Did you mean…?” with a one-click Fix.
[email protected] → [email protected] (default action: suggest)
A maintained throwaway list, plus the mail servers behind new ones.
[email protected] → blocked (default action: block)
NXDOMAIN, null MX or no mail host. Nobody will ever confirm.
[email protected] → no mail server (default action: block)
Typo-squats that accept mail. Your welcome email would reach a stranger.
[email protected] → live MX, not Gmail (default action: warn)
Dots, +tags and googlemail.com collapse into one identity.
[email protected] = [email protected] (default action: warn)
Datacenter, VPN and Tor networks, plus browser-vs-IP timezone mismatches.
AS14061 · DigitalOcean → flagged (default action: flag)
More signups from one IP in an hour than your burst limit allows.
16 signups · 1 IP → blocked after 5 (default action: block)
A hidden field only bots fill. On Pro, signed tokens also stop direct API posts.
hidden field filled → blocked (default action: block)
Day-zero audit
Paste a few recent signups or drop your whole CSV. Vetto finds typos, throwaway inboxes, dead domains and alias clusters before you install anything.
Or drop your whole signups CSV here (Stripe, Supabase, Postgres, any export)
Emails never leave your browser — only domain names are checked.
Free audits summarize the first 1,000 rows. Pro audits every row and exports the flagged ones.
More free tools: disposable email checker, email typo checker, Gmail alias checker and the disposable domains list.
How it works
Before </body> on any page with a signup form. Every email field is guarded; nothing else changes.
<script src="https://usevetto.com/v.js" data-site="pk_xxxxxxxxxxxxxxxxxxxx" defer></script>Pick what each signal does. Start gentle with warnings; tighten when the ledger agrees.
Rescued, blocked and dollars saved, every day. You set what a real signup is worth and what a fake costs you.
rescued × $29 signup value
+ blocked × $0.50 compute per fake
= $ saved this week
Built to be boring in production
A signup gate that breaks is worse than none. Vetto is designed to step aside whenever it is unsure.
If Vetto is slow or down, your form submits as if Vetto were not there. An outage on our side never blocks a signup on yours.
Salted hashes only, used for 90 days of repeat detection, then ignored and purged automatically. Your verdict log shows masked addresses like ja•••@gmail.com.
Apple Hide My Email, Firefox Relay, addy.io and SimpleLogin users are real people. They pass, tagged.
Vetto reads public DNS only. It never connects to mail servers to test inboxes, so nothing gets greylisted or blocklisted.
If it renders an HTML form, one script tag covers it. On Pro, forms that never touch a browser can call /v1/check from your server with your secret key.
Pricing
Start free on one site. Upgrade when the ledger shows it pays for itself.
For your first site and your first fakes.
$0forever
Start freeNo card needed.
Every signal, enforced on your server.
$12/ month
Get Pro: $12/monthGet Pro: $99/yearGumroad membership · cancel anytime.
Pro forever for less than one year of Pro ($99). First 100 buyers, until Black Friday Nov 27, 2026.
$69once
Get Pro for life: $69One payment via Gumroad · no renewals.
After checkout, paste the license key from your Gumroad receipt into Dashboard → Billing.
At ~$0.50 of compute per fake AI-tier account, 24 blocked fakes a month pay for Pro — so does one rescued signup.
FAQ
Something else? Start free (no card) and try it on your own form. Paying customers can reply to their Gumroad receipt.
It is built not to. Privacy relays (Apple Hide My Email, Firefox Relay, addy.io, SimpleLogin) are allowed and tagged. Uncertain signals warn first: the visitor sees a message and the second submit goes through. And if Vetto does not answer within 800 ms, the form submits as if Vetto were not installed.
No. Vetto keeps salted hashes for repeat and alias detection, used for 90 days, then ignored and purged automatically, and your verdict log shows masked addresses (ja•••@gmail.com). The demo and the CSV audit on this page store no email addresses; the audit only sends domain names.
On Pro, every guarded form gets a signed vetto_token field when it submits. On your server, verify it with one call to POST /v1/verify, or offline with a short HMAC check. Reject a token that is present but fails verification. An empty token means Vetto failed open (slow, paused or over quota) or the request skipped your form: accept it, or re-check it server-side with POST /v1/check and your secret key. On Free, the hidden honeypot field still catches simple bots.
No. v.js is a static script of about 4 KB gzipped, loaded with defer and cached at the edge. It makes no request until someone uses an email field, and any check slower than 800 ms is skipped.
Anything that renders an HTML form: Plain HTML, Framer, Webflow, Next.js, Supabase, Better Auth, Rails, Laravel. Limit it to specific forms with data-forms, skip a field with data-vetto-ignore, or (on Pro) call /v1/check from your server for forms that never touch a browser.
Buy Pro or Lifetime on Gumroad. Your receipt contains a license key: paste it into Dashboard → Billing and Pro unlocks for your account right away.
Yes. Pro is a Gumroad membership: cancel anytime from your Gumroad receipt or library. When it ends, your account falls back to the Free plan and your sites keep running on Free limits. Lifetime is a single payment with nothing to cancel.
Free on one site. One line of HTML. Remove it any time and your form works exactly as before.
Founding offer: Pro for life for $69 once, first 100 buyers, until Nov 27.