Kit Users: prevent suspicious signups

Hopefully, this will help someone else from making the same mistake with Kit.

I discovered a bunch of new subscribers with strange emails like "metamphetamine@kypit-v-ukraine.online" and "cocaine-kokain@cocaine-v-russia.online". I immediately contacted Kit (aka Convertkit) through their chat. Their advice:

1. Delete these suspicious subscribers immediately - you can do this by selecting them on your Subscribers page and using the Bulk Actions menu to remove them.

2. To prevent future spam signups:

• Enable Double Opt-in on all your forms if not already enabled

• Make sure 'Auto-confirm Subscribers' is unchecked

• Enable CAPTCHA on your forms

I have double opt-in enabled and auto-confirm was not checked on any form. However, I found one single solitary form where “invisible reCAPTCHA” was not checked (meaning it was disabled). They took full advantage of that open door.

The good news - CAPTCHA is automatically enabled on all new forms you create. But you might want to check your old ones, just in case.