We are developing a web application, and we would like to make it very easy and effective for our users to invite their friends, family and colleagues to view and interact with their content on the application.

Invite your friends by email

We are considering the standard form where the user inputs a series of comma-separated email addresses These addresses would receive an email from our service, containing customized links to the content, etc.

Our concern is that spammers (bots and/or humans - i.e. captcha isn't sufficient) may create marketing content on our website, and take advantage of the email invite feature to distribute unsolicited content. This could result in users reporting these emails as spam, potentially compromising our ability to reach out to users.

Possible solutions we've considered:

  • Requiring users to enter their email address & password, then fetching their contacts, and delivering the emails from that user's account via SMTP.
  • Emphasizing social media channels as a delivery method instead.

The problem with the first of these is that users may be less than eager to offer their email credentials.

We consistently find examples of websites which offer the same function outlined above: specify arbitrary email addresses, and we'll send them an email.

Is there a way to do this safely & effectively?

P.S. Moderating usage of the feature is not feasible (administrative approval of outgoing requests). There is no way to distinguish between legitimate & illegitimate usage.

1 Answer 1


You should probably just rate-limit.

For example, who generally invites more than 10 friends and family members a day? Give, as google does, a number of invites that gets used up, and then regenerates over time. And reward people who get other people to sign up on the site with more invites, people who send out invites that get no response don't get their invites regenerated (should probably do that in general anyway).

New users don't get to invite within the introductory time period, that'll also cut down on usage by spammers.

  • Couldn't the attack just create more accounts and send more email that way.
    – Gerry Shaw
    Commented Dec 1, 2012 at 1:36
  • I think that would be relatively well protected against by disallowing invites from new accounts and also regenerating invites for old accounts based on whether prior invites have been actually acted upon.
    – Kzqai
    Commented Dec 1, 2012 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.