Quick Answer
Any online poll that accepts a vote from anyone, without checking who they are, can be flooded — and if the result decides something people care about, eventually it will be. This is not a flaw in a particular poll site. It is what an open poll is.
The three defences most polls rely on all fail against someone mildly determined:
| Defence | Why it fails |
|---|---|
| Cookie or local storage | Cleared, or the browser opens in a private window. Costs the user two seconds. |
| IP address limits | One household shares an IP, so limits punish real voters. Meanwhile the address is trivially rotated, and mobile networks reassign addresses constantly. |
| CAPTCHA | Raises the cost of an automated vote. Does not raise it to zero, and does nothing at all against a hundred real people asked to vote in a group chat. |
The only thing that structurally works is checking that each ballot came from a distinct, identified person before counting it — a confirmed email address or phone number, checked against a list of who is eligible. Everything else is friction, and friction only deters people who were not trying very hard.
If you are here because your own poll looks wrong, skip to the four signals.
A note on what this article does not contain: it explains the shape of poll manipulation so you can recognize and prevent it. It does not provide tools, services, or instructions for doing it.
Why Open Polls Get Flooded
An open poll is a form. It collects a click and adds one to a number. It has no idea who you are, and by design it does not ask.
That is completely fine for the enormous number of polls where nothing is at stake — what to name the office plant, which day suits everyone for lunch, whether people liked the episode. The absence of verification is a feature there: no signup, no friction, more responses.
It stops being fine the moment the result decides something. A contest with a prize. A community deciding on a rule. A board election. A public consultation someone will cite. As soon as an outcome has value, the poll's openness stops being convenience and becomes the attack surface, because the cost of an extra vote is approximately zero and the benefit of winning is not.
The uncomfortable part is that most flooding is not sophisticated. The great majority is one of two things:
A person voting repeatedly. Private window, phone on cellular data, a friend's laptop, clear cookies, repeat. No tools, no skill, ten minutes.
A group asked to vote. Someone posts the link to a large community with "please vote for us." This is not automated at all, and it is why brigading is far more common than botting. Every individual vote is a real human being. The result is still not a measurement of the population you meant to poll.
Automated tools exist, and they are a genuine problem for high-profile public polls. But if your poll went sideways, the odds strongly favour one of the two above.
The Four Signals in Your Own Data
If you suspect a poll you are running has been flooded, these are the patterns to look for. None is conclusive alone. Three together usually are.
1. The shape of the timeline is wrong
Organic voting is lumpy in a recognizable way: a spike when you announce, decay over hours, small bumps when someone reshares, near-silence overnight in your audience's timezone.
Flooded voting looks different. Either a flat, sustained rate that does not decay — the signature of automation, because software does not get bored — or a vertical wall of votes arriving in a few minutes with no corresponding traffic anywhere else. Export the timestamps and plot them. This one signal catches most cases.
2. Traffic and votes do not match
Compare your poll's vote count against your analytics for the page. Real voters read something, hesitate, and some leave without voting, so votes are normally a fraction of visitors. If you have 4,000 votes and 300 page views, the votes did not come from people reading your page.
Related: check referrers. A sudden dominant referrer you have never seen, or a wall of direct traffic when your poll was only ever shared in one newsletter, is worth a look.
3. The result does not move, at all
Genuine results wobble. Early votes skew toward whoever shared first, then the margin drifts as different groups arrive. A margin that snaps to a ratio in the first hour and then holds that ratio to two decimal places across thousands of subsequent votes is not how crowds behave.
4. One option has no human tail
In a multi-option poll, real audiences distribute untidily across every option, including the unpopular ones. Manipulation is usually aimed at a single option. If one choice climbs steeply while every other option's rate stays exactly where it was before the climb started, the new votes are not coming from the same population as the old ones.
What to do if you find it. Say so publicly and quickly, with the evidence. "We are voiding this poll because 3,200 votes arrived in nine minutes from one referrer" costs you far less credibility than quietly certifying a result people already suspect, or than silently deleting votes and announcing a different number. Then re-run it in a form that cannot be flooded.
Honest question
Would you trust an online vote to decide your community's annual budget?
What Actually Stops It
The fix is structural, not defensive. Stop trying to detect bad votes after they arrive and start requiring that each vote come from someone you can distinguish from everyone else.
Confirmed email or SMS. Each voter receives a private, single-use link at an address or number they control. Casting a second ballot requires a second real address or phone, which raises the cost from zero to genuinely inconvenient. This is enough for the overwhelming majority of real-world votes.
A closed roster. Stronger still, and the right answer whenever there is a defined electorate — members, owners, employees, students, a congregation. You upload the list of who may vote. Everyone else is not slowed down, they are simply not eligible. Nothing to detect, because a non-member's vote never enters the count.
Government-ID verification. For votes where identity itself is contested or the stakes justify it, an ID check per voter. It is the strongest option and it is the highest-friction one, which is why it belongs on a minority of votes rather than all of them.
The trade-off is honest and worth stating: verification reduces raw response counts. Some people will not confirm an email to answer your question. That is the correct outcome — you are exchanging a large meaningless number for a smaller number that means something. If what you need is engagement, run an open poll and describe it as one. If what you need is a result somebody will act on, verify.
vote.direct does both deliberately. Open polls are free and unlimited, and honestly labelled as unverified. Verified elections confirm every voter against a roster and start at $4.99 for up to 50 voters. The poll maker will run either, and you can start open and switch.
What Verification Does Not Fix
Being straight about the limits, because vendors usually are not.
It does not stop brigading by eligible voters. If your electorate is genuinely everyone in a large community, and one faction turns out and the other does not, that is a real result you may not like. Verification establishes that each ballot came from a distinct eligible person. It does not make the electorate representative.
It does not make an unrepresentative sample representative. A verified web poll is still a self-selected sample. It is a vote, not a survey. Do not report it as public opinion.
It does not fix a badly worded question. No amount of identity checking rescues a leading question or a missing option.
It is not a guarantee. A determined person with several real phone numbers and email addresses can cast several verified ballots against an open electorate. Against a closed roster they cannot, because they would need to be several members. This is why the roster, not the verification method, is the thing that actually carries the weight.
Choosing Between Open and Verified
| Your poll | Use |
|---|---|
| Fun, engagement, temperature check | Open poll. Say it is unverified. |
| Anything with a prize | Verified, and publish the rules before opening |
| Members, owners, employees, students | Verified against a roster |
| A board or officer election | Verified against a roster, with a result record |
| Anything with a legal or financial consequence | Verified, with an audit trail |
The failure that costs organizations real money is not running an open poll. It is running an open poll and then treating the result as if it had been an election. We wrote about what that costs in the hidden cost of unverified polls, and about the wider security picture in online voting security.
FAQ
Q: How can you tell if an online poll has fake votes?
Look for four things together: a vote timeline that does not decay or arrives as a vertical wall, vote counts that exceed plausible page traffic, a margin that locks to a fixed ratio and stops moving, and a single option climbing while every other option's rate is unchanged.
Q: Do CAPTCHAs stop poll bots?
They raise the cost of automated voting without eliminating it, and they do nothing against a real person voting repeatedly or a group asked to brigade a link. Treat a CAPTCHA as a speed bump, not a control.
Q: Does blocking by IP address stop duplicate votes?
Poorly. Households, offices, schools, and campuses share addresses, so IP limits block legitimate voters, while mobile networks and ordinary network changes hand out new addresses constantly.
Q: Can you stop people voting twice in an online poll?
Not reliably in an open poll. You can make it substantially harder by requiring each ballot to come from a confirmed email address or phone number, and you can make it effectively impossible by restricting voting to a roster of known eligible people.
Q: Are free online polls accurate?
They accurately report the clicks they received. They are not a measurement of any defined population, because there is no control over who clicked or how many times. That is fine for engagement and wrong for decisions.
Q: What should I do if my poll was flooded with fake votes?
Void it publicly, state the evidence plainly, and re-run it with verification. Quietly certifying a result people already doubt, or silently deleting votes, costs more credibility than admitting the poll was open.
Q: Is it illegal to vote multiple times in an online poll?
For a private or promotional poll it is usually a terms-of-service matter rather than a criminal one, though contests with prizes can raise fraud questions, and organizations have brought civil claims. Elections conducted under a statute are an entirely different matter with real penalties. This is not legal advice.
The Bottom Line
Open polls are not broken. They are open, which is a different thing, and it is exactly what most polls should be.
The mistake is asking an open poll to carry a decision. If the answer will be acted on, spent against, or cited by someone else, the poll needs to know who voted — not to make voting harder, but so the number at the end is worth the argument it will have to survive.
vote.direct keeps open polls free and unlimited, and clearly labelled as unverified. When the result has to hold up, verified elections confirm each voter against your roster and finish with a tally, a timestamp, and an exportable record. From $4.99 for up to 50 voters.
Poll already flooded and need to re-run it properly? Call or text (512) 222-8191, or email [email protected]. We have helped a fair number of people out of this exact hole.
This article is general information, not legal advice. We recommend you do your own research and confirm anything you plan to act on. Where this article states law, the section is cited so you can read the primary source yourself rather than take our word for it — that is what the citations are for. Election requirements also turn on your own governing documents, which we have not seen, and statutes are amended. For advice about your community, consult a qualified attorney licensed in your state.
We work hard to verify every citation against the primary source, but laws change and errors happen. If you spot an inaccuracy, email [email protected] and we will correct it. See our editorial standards for how these pages are researched and checked.
