Strategies for Safeguarding REDCap Surveys Against Bot Attacks

This page outlines security protocols for study teams deploying public REDCap surveys.

Protecting REDCap surveys from bots and malicious actors is absolutely critical to safeguarding data integrity, preserving funding resources, and ensuring valid research outcomes. When surveys—particularly those offering financial incentives—are left vulnerable, automated scripts can rapidly flood projects with thousands of fraudulent, hyper-accelerated responses. This influx of fake data not only contaminates your dataset and renders statistical analysis useless, but it can also instantly deplete your study's incentive budget before genuine human participants ever have a chance to respond. Ultimately, implementing robust bot defenses is not just a technical precaution, but a fundamental step in upholding the scientific validity and ethical standards of your research. 

REDCap Configuration Settings

When building your survey in the Online Designer, configure these defensive settings:

• Enable Google reCAPTCHA: Turn this on in the "Survey Settings" for any public-facing form. It forces suspicious traffic to complete a puzzle challenge before submitting.

• Deploy a Hidden Honeypot Field:

  • Create a text field named something inconspicuous (e.g., middle_initial_verification).

  • Apply the @HIDDEN-SURVEY action tag to it.

  • Rationale: Human participants will never see this field, but automated bot scripts read the raw HTML code and blindly fill it out. Any response containing data in this field is an automatic bot submission.

• Add  instruction-based attention checks: e.g., "Type the word 'blue' in the box below". Any responses containing nonsensical text will be from a bot submission.

• Set Response Limits: Under Survey Settings, establish a hard cap on total allowed submissions. If a bot farm attacks your link overnight, this cap prevents them from generating thousands of fake records.

• Set a Survey Expiration time: Under Survey Settings, set a time after which the survey will become inactive. This will prevent bots from finding and completing the survey after your project has finished.

• Utilize survey URL parameters: You can append custom parameters to your public survey URL. When sharing the survey across diverse platforms or groups, this strategy enables you to track submission sources and flag any responses missing parameter data as potentially illegitimate.

High-Risk Incentives & Distribution Strategy

Never post a reusable, public survey link on social media or public forums if an incentive is promised automatically.

• Implement a "Gatekeeper" Design: Split your protocol into two separate REDCap projects:

  1. The Screener (Public): A short, bot-protected form collecting basic eligibility and contact info (email/phone).

  2. The Review Process: The study team audits screener responses for bot signatures.

  3. The Main Survey (Private): Use the REDCap Participant List in a separate project to email a unique, single-use survey link only to verified, eligible human participants. (Using the participant list preserves anonymity.)

• Decouple Incentive Delivery: Never display a gift card code on the survey confirmation page.

• Batch and Hold Disbursements: Process payments in weekly or bi-weekly batches. This buffer allows your team time to review paradata, run quality checks, and withhold funds from fraudulent entries before the money leaves your account.

Data Screening & Post-Collection Audits

Before analyzing data or distributing incentives, the study team must review the dataset for the following digital red flags:

• Honeypot Responses: Review your built-in honeypot questions. Any response containing data in this field is an automatic bot submission.

• Completion Velocity: Monitor the time elapsed between the survey start and submission. For example, if a 40-question survey is completed in less than 30 seconds, flag it as an automated script.

• Straight-Lining & Patterned Answering: Look for records where the respondent selected the exact same multiple-choice option (e.g., all "A"s or "Strongly Agree") across the entire instrument.

• Nonsensical Text: Audit open-ended text fields for random strings of characters, pasted gibberish, or text that fails basic instruction-based attention checks (e.g., "Type the word 'blue' in the box below").