Hi @akamat, Archiving 200 at a time was a great idea as a cleanup workaround, but prevention needs to happen when the registration is submitted, not after the person appears in the event.
Assuming this was in Eightfold Events, here’s what I’d recommend:
1. Have Support verify that event reCAPTCHA is enabled
Eightfold supports Google reCAPTCHA on public event registrations. It’s configured separately from the career-site application CAPTCHA, and the documented default is off. Support should check recaptchaEnabled and the configurable recaptchaMinScore for your environment.
This is the first safeguard to check, but it’s not a guarantee.
2. Request stronger registration controls if the event must stay public
I’d ask Support/Engineering to assess:
- Registration-specific throttling across sessions and events, not just individual IP addresses.
- Stronger bot challenges for suspicious submissions.
- Email verification before a registration is finalized, with limits on verification requests themselves.
These are recommendations to evaluate, not features I can confirm are currently available as standard settings for public Eightfold Events. Email verification is documented for candidate-portal accounts, but that does not establish that it gates public event registration.
3. Consider invite-only registration when broad public access isn’t necessary
Eightfold documents an invite-only event workflow. Ask Support to confirm that your event type enforces only invited candidates can register, rather than simply distributing a public registration link to a smaller list. An invitation-only restriction has been configured for an interview-event implementation, so applicability needs to be checked for your setup.
Recommended next step
Open a Support case with the event URL, time window of the spike, and a few confirmed spam examples, and request:
“We received approximately 700 spam registrations within a few hours. Please verify event reCAPTCHA is enabled and functioning, investigate how these submissions were accepted, and recommend controls that reject suspicious registrations before they are created. Please also confirm whether enforced invite-only registration is supported for this event type.”
If another wave is underway, temporarily closing registration is a containment option. Suppressing confirmation emails/SMS can limit downstream impact, but does not prevent registrations.
Was this in Eightfold Events or another event platform? That will determine which controls you can enable directly versus request through Support.