Every registration (including via the API) runs through a set of automatic checks before the account is created — none of these need to be configured by you:

• Disposable/throwaway email domains are rejected.
• Bot-pattern names (known fake name pairs used by carding bots) are rejected.
• Spam names — a URL stuffed into the name field, or the same promotional phrase duplicated into both name fields — are rejected (this catches link/SEO spam signup waves).
• Datacenter/proxy network signups are blocked, even if that network is on the login allowlist — the allowlist only protects existing customers' logins, not brand-new signups.
• IP velocity — too many signups from the same IP in a short window — is blocked.
• Global velocity — a burst of signups site-wide in a short window, even from different IPs — is blocked as a backstop.

Every blocked attempt is logged and shows up in Signup Allowlist > Recent blocked signups so you can allowlist a real customer who gets caught by mistake (viewing that log is limited to Sprwt SuperAdmins). A signup form can optionally also require a CAPTCHA challenge, but that's off by default and not exposed as a Client Config toggle in the current version.