How SongBattle's anti-fraud voting actually works

Every music competition on the internet gets asked the same question by artists: is the voting real?

Because the honest answer for most of them is no. Bot farms, click services, and coordinated multi-device rings are cheap and easy. If a platform doesn't take fraud seriously, the winner is whoever paid the most for fake votes — not the artist the crowd actually picked.

SongBattle takes it seriously. Here's exactly what's running behind the vote button, in plain English.

The six layers

1. Device fingerprinting

Every browser leaves a unique combination of signals when it loads a page — screen size, timezone, installed fonts, canvas rendering behavior, audio-context traits, and a dozen other properties. Combined, these form a fingerprint that identifies a specific browser session with high accuracy, even if the user clears cookies or opens an incognito window.

We hash that fingerprint (one-way, so we're not storing your raw traits) and use it to enforce one ballot per device per round. If your fingerprint has already voted this round, you can't vote again.

2. Hashed IP rate limiting

We also hash your IP address (again one-way — the raw IP is never stored) and use it as a second signal. If we see 50 votes come from the same hashed IP within an hour, that's a red flag for a bot farm running on a single server or a public Wi-Fi network being abused.

We don't automatically block on IP alone (that'd unfairly hit dorms and offices), but IP is one input into the pattern-analysis layer below.

3. CAPTCHA (Cloudflare Turnstile)

Before your vote is submitted, you have to pass a Cloudflare Turnstile challenge. This is a modern replacement for the old "click all the traffic lights" reCAPTCHA — it works silently in the background for real humans and only shows a puzzle if it detects automated behavior.

Turnstile stops the vast majority of dumb bots and script kiddies. It's not perfect against sophisticated attackers, but it raises the cost per fake vote enough that most abuse gives up.

4. Watch-time gate

Here's the one that's uniquely painful to fraudsters: you have to actually watch part of an artist's video before you're allowed to vote for them. We track playback time through YouTube's IFrame Player API. Only once you've watched at least 25% of the song does that artist become eligible on your ballot.

This means a bot has to actually load and play videos to accumulate votes — which is orders of magnitude more expensive than just POSTing to a vote endpoint. Real fans who care enough to watch a song end up as the actual voting population.

5. Pattern analysis

Behind the scenes, we look for signals that don't fit organic voting behavior:

• Timing: All votes coming in exactly 3 seconds apart? Bot.
• Referrer: Every vote coming from the same shady URL that isn't songbattle.co? Bot.
• Artist concentration: One artist getting 90% of their votes from IPs that never voted for anyone else? Coordinated ring.
• User agent anomalies: Combinations of browser + OS that basically don't exist in the real world? Bot.
• VPN / proxy detection: Votes routed through commercial proxy services known for evading per-device limits? Flagged.

Suspicious votes are pulled into a review queue before they count. They only get added to an artist's leaderboard total after they clear review.

6. Post-hoc invalidation

Even if a fake vote slips past all five layers above, we can invalidate it after the fact — including after the contest ends. Contest Rules §7 makes this explicit: the official winner is the artist with the highest verified vote total after all anti-fraud removals, not the artist who was leading on the display leaderboard mid-competition.

If your team is running fake votes, you don't win by getting them counted temporarily. You get disqualified, and the prize goes to the next eligible entrant.

What this means for artists

If you're playing fair: you never notice any of this. Your fans watch your video, vote, and their vote counts. The leaderboard rewards you if you have real fans, not the most money to spend on click farms.

If you're not: you get caught. We remove your votes, disqualify your entry, and — if you've already been paid a prize — you're required to return it under Contest Rules §7. Every entry is signed as a binding representation on the entry form.

If you're worried about a competitor cheating: flag it. Email info@songbattle.co with your slug and the artist you're concerned about. We investigate every credible tip.

What this means for fans

Your vote actually matters. That's the whole point.

When you cast a ballot, you're not one voice in a million pretending it counts against a wall of bots. You're one voice in a filtered, verified pool where the manipulation has been removed before you got here. If your favorite artist wins, it's because the crowd — the real crowd — picked them.

What this doesn't do

Anti-fraud is a moving target. New attack patterns show up every month, and no system is 100% bulletproof. We're not going to pretend otherwise. What we can promise:

1. We take every fraud report seriously and investigate.
2. We disclose our methodology publicly (this post) instead of hiding behind "trade secrets."
3. We publish results only after the anti-fraud sweep is complete.
4. When we find something new, we add a new layer. This post gets updated.

That's the deal. Come compete, come vote, and know the leaderboard is real.

Ready to enter? → songbattle.co/enter Ready to vote? → songbattle.co/vote

—

Related:

• Why we built SongBattle
• The Official Contest Rules