A bot attack on a Klaviyo popup looks the same in every store: hundreds of new profiles overnight, many with random strings at real domains, some at throwaway inbox services. Your welcome flow fires for each one. The bounces and spam complaints that follow land on your sending reputation, not the bot's.
Klaviyo profiles you never email don't hurt you, but the welcome flow emails them within minutes. So the fix has two parts. You check the address as the profile arrives, and you keep flows away from the bad ones.
The short version
- Klaviyo access to lists, segments, flows and profile properties
- A ZapBounce API key and a Zapier account, or a form handler you host yourself
The steps
Add a delay at the top of the welcome flow
Open the welcome flow triggered by your signup list and add a short time delay as the first step. That gives the check time to finish and write its answer before the first email goes out.
Trigger a Zap on new list members
In Zapier, choose Klaviyo as the trigger app and pick the trigger for a profile added to your signup list. Run a test signup with your own address so the email field maps.
Verify the address with ZapBounce
Add the ZapBounce Verify email action and map the email field. It returns
valid,invalid,catch_allorunknown, withdisposableandroleflags beside the result. Field details are on the Zapier integration page.Save the result on the profile
Add a Klaviyo step that updates the profile with a custom property, such as email_check, set to the result, and a second property for the disposable flag.
Filter the welcome flow
Add a flow filter or a conditional split after the delay: continue only when email_check is valid or catch_all and the disposable property is false. Everyone else leaves the flow before the first send.
Suppress the fakes
Build a segment where email_check is invalid or the disposable property is true. Review it once a week and suppress those profiles, so no campaign reaches them by accident.
Clean the profiles already on the list
Export the list as CSV, verify it on the bulk page, and import the results back matched on email. The Klaviyo list cleaning guide walks through that import.
Blocking fake signups before Klaviyo sees them
If your popup posts to your own server first, check the address there. Call POST /v1/verify, and subscribe the address to Klaviyo only when the result isn't invalid and disposable is false. The real-time verification page covers the call and the timeout.
Show the did_you_mean suggestion when there is one. A shopper who typed hotmial.com and sees a one-tap fix stays a real subscriber and gets the discount code you promised.
Why bot signups hurt a Klaviyo sender
Bots often submit addresses at real domains that don't exist, and each one returns a hard bounce the moment your welcome email goes out. Some attacks use real people's addresses, which turns your welcome email into mail they never asked for and invites a spam complaint.
Verification handles the first kind: an address that doesn't exist comes back invalid. For the second kind, turn on double opt-in for the signup list, because only the owner of the inbox can click the confirm link. The two checks cover different halves of the same attack.
What verifying Klaviyo signups costs
Each new subscriber costs one credit when we get an answer from the mail server. An unknown is never billed, a duplicate is never billed, and credits never expire, so a slow month costs nothing. Checks start at $5 for 1,000, and every account gets 100 free checks a month with no card. See the pricing page.
Questions people ask
Why am I getting so many fake signups in Klaviyo?
Most sudden waves of fake Klaviyo signups come from bots that fill every visible form they find. Verifying each new address and adding double opt-in to the signup list stops most of them from reaching a send.
How do I remove fake profiles from Klaviyo?
Export the list, verify it, import the result as a profile property, and build a segment of invalid and disposable profiles. Suppress that segment so no flow or campaign emails it again.
Does Klaviyo double opt-in stop bot signups?
Double opt-in stops bot signups from becoming subscribers, because only the inbox owner can click the confirm link. Each fake still triggers one confirmation email, so pair it with verification to stop the bounces from those.
Does ZapBounce email my Klaviyo subscribers when it checks them?
No. ZapBounce ends the SMTP conversation after RCPT TO and closes before any message data, so subscribers receive nothing from the check.