Stopping bots and scalpers from taking your drop

The problem is allocation, not traffic

When a drop goes to resellers, the failure people describe is “the bots got there first”. That is accurate, and it points at the wrong fix.

Blocking bots is a detection problem, and detection is an arms race you are playing against people who do it full time. Every improvement you make is a thing they route around, and the moment your detection is good enough to be worth beating, the traffic beating it looks more like a human. You will never announce that you have won.

Meanwhile the actual failure is simpler. Your queue promised first-come, first-served. Something arrived first. It was a script, because a script is better at arriving than a person is, and the queue did exactly what it said it would.

A fair rule produced an unfair result. That is the thing worth attacking.

What screening at the door is for, and what it isn’t

We run a bot check before anyone joins the line, and it does real work: it keeps the crude, high-volume scripted traffic out of the queue, which matters because a queue full of scripts is a queue where a real person’s position means nothing.

What we will not do is put a number on it. We publish no detection-efficacy figure, no “blocks 99% of bots”, no caught-bot counter. Anyone quoting one is quoting a number they cannot substantiate against an adversary who is still adapting, and on a page whose job is to be trusted that is worse than saying nothing.

Screening is necessary. It is not sufficient, and a vendor selling it as sufficient is selling you the arms race.

Removing the reward instead of fighting the race

The alternative is to make arriving first worth nothing.

In a presale drop, registration opens over a window — an hour, a day, however long you choose. Nobody is given a position while it is open. When the drop starts, every position is assigned at once by keyed pseudorandom permutation. Someone who registered in the opening millisecond and someone who registered 47 minutes later have identical expected position.

Think about what that does to the economics on the other side. A script’s entire advantage is speed. If speed buys nothing, the only thing left to buy is volume — more registrations, more identities — and that is a much more expensive, much more visible attack than being fast, and it is the one screening is genuinely good at catching.

You have not eliminated the adversary. You have moved the fight onto ground where you are not structurally losing.

Be clear about the scope: this is what a presale does. An ordinary queue here is first-come, first-served by ticket sequence, the same as everyone else’s. And we are not unique in offering a draw — Queue-it ships randomisation at event start too. What is unusual is that it is standard rather than an enterprise feature, and that we will explain the mechanism in public.

One admission should not become five orders

The other half of the problem happens after the door. Somebody gets in legitimately, then converts one admission into a handful of orders — parallel sessions, a shared link, a pass forwarded to a group chat.

Each pass here is signed and single-use, and on WooCommerce that is enforced at the order, not just at the page: the plugin spends the pass when payment confirms, so a spent pass cannot be replayed, forwarded, or fanned out. The edge connector does the other half of the job — it sheds the crowd at Cloudflare so queued traffic never reaches your store — but it has no notion of an order and does not police allocation on its own. Both together is the strongest configuration, and the WooCommerce page says exactly which half does what.

The admission rate is a bot-defence control, and nobody sells it as one

Here is the part that gets missed. How fast you let people in decides how much a bot is worth.

Release 500 units at 200 admissions a minute and the drop is over in two and a half minutes — a window narrow enough that being milliseconds faster is decisive, which is exactly the condition a script is built for. Stretch the same 500 units over an hour and speed stops being the differentiator.

That number is a floor for some vendors. A Cloudflare waiting room cannot be configured below 200 admissions a minute; the minimum is in their own documentation. CrowdHandler’s entry tier caps outflow at 60 a minute, which is a different problem — you cannot speed it up either.

Here it is a dial with no floor and no ceiling, the same on every plan. It is a pricing-page column because it is a drop-control feature, and it happens to be the most useful anti-scalping lever you have.

Fairness is a brand-safety purchase

Drop audiences are communities, and they talk. A drop that is widely believed to be rigged does damage that outlasts the stock, and “we used a queue” has stopped being reassuring on its own — there is a live cottage industry of proxy vendors, CAPTCHA solvers and skip-the-line guides built around the incumbents, which tells you roughly how much trust queues command.

That is why the mechanism is written down in public rather than described as proprietary. A queue nobody can check is a queue nobody believes.