> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://learn.nuwebgroup.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://learn.nuwebgroup.com/_mcp/server.

# How do ticketing platforms control bots during onsales?

> Methods for reducing automated abuse without blocking legitimate buyers.

**Ticketing platforms control onsale bots through layered protections rather than a single CAPTCHA or rate limit.** Measures can include request throttling, device and behavioural signals, challenge flows, authenticated presale access, purchase limits, and post-order fraud review. No control guarantees that only humans obtain tickets, and aggressive controls can exclude legitimate customers.

## What behaviour should be controlled?

Ticketing abuse is broader than page scraping. Automated clients may hammer event availability endpoints, create large numbers of basket reservations, enumerate access codes, attempt account takeover, or place repeated orders. Each requires a different response. Traffic volume alone is an imperfect indicator: a popular real onsale also produces bursts of genuine traffic.

| Threat pattern                     | Possible response                               | Main trade-off                     |
| ---------------------------------- | ----------------------------------------------- | ---------------------------------- |
| **Excessive availability polling** | Endpoint-specific rate limits and caching       | Stale inventory indicators         |
| **Mass reservation attempts**      | Per-account limits and short holds              | Shared-household false positives   |
| **Credential stuffing**            | Identity risk checks, MFA options               | Customer friction                  |
| **Access-code guessing**           | Entitlement-bound codes and attempt limits      | Recovery for legitimate recipients |
| **Repeated checkout abuse**        | Velocity review and idempotent payment requests | Declining genuine attempts         |

## Where should controls sit?

Use edge controls to filter clearly abusive traffic early, but verify authorisation, entitlement and business limits in the application itself. A browser challenge cannot safely replace server-side limits on basket holds or ticket quantities. Protect APIs used by mobile apps and partners as well as the public website, otherwise abuse moves to whichever route is least restricted.

## How can ticketing bot controls avoid blocking genuine buyers?

Measure challenge completion, legitimate rejection appeals, conversion by device and geography, and incidents involving accessible technologies. Provide a recovery path for customers sharing a network, travelling, or using assistive tools. Explain why an action was blocked without revealing security detection rules.

**Example:** A customer refreshing a seating chart several times should not be treated as the same threat as an automated client creating hundreds of unpaid reservations. Adaptive controls distinguish interaction patterns rather than blocking both at the same threshold.

## What makes a control effective?

Evaluate bot mitigation alongside inventory integrity, queue throughput, basket expiry and payment success. A lower request count is not necessarily better if paid order completion collapses. Retain auditable decisions and use tests that do not unfairly deny real purchasers access.

## Related explanations

#### [How do ticketing platforms handle high-demand onsales?](/scale-reliability/how-do-ticketing-platforms-handle-high-demand-onsales)

Scale & Reliability · High-demand onsales

#### [How do large ticket presales manage access codes?](/scale-reliability/how-do-large-ticket-presales-manage-access-codes)

Scale & Reliability · High-demand onsales

#### [What is a pre-queue in ticketing?](/scale-reliability/what-is-a-pre-queue-in-ticketing)

Scale & Reliability · High-demand onsales

#### [How can ticketing platforms support new countries and event types?](/scale-reliability/how-can-ticketing-platforms-support-new-countries-and-event-types)

Scale & Reliability · Growing the business

[More in Scale & Reliability →](/scale-reliability)