Bots, Spam and Surprise Bills: How to Protect Your Website Chatbot

Yes, a website chatbot can be abused in ways that cost you money, but for a small business the risks are specific and mostly fixable. Bots and freeloaders can burn through your message allowance, spammers can fill your inbox through the contact form, and someone can copy your widget onto their own site. The defenses are just as plain: per-visitor rate limits, a list of websites the bot may run on, a bot that stays on topic, and a plan with a hard monthly cap instead of a bill that grows with every conversation.

I build ChatBento, an AI chatbot for small business websites, so I deal with this from the inside. Here's what actually happens to a public chatbot, which risks matter, and what each defense does and doesn't do.

How much of your website traffic is bots?

More than half of it, by one large measure. Thales, which owns the bot protection company Imperva, says in its 2026 Bad Bot Report, announced April 29, 2026, that bots made up more than 53% of all web traffic in 2025, up from 51% the year before. That's what Thales's researchers measured, not your site, and it comes from a company that sells bot protection, so read it as a direction.

Most of that traffic never talks to your chatbot. A simple scraper downloads your page and leaves without running the widget's script. The ones worth thinking about are scripts that drive a real browser, and real people who find your bot and decide to use it for something you didn't intend.

Five ways a small-business chatbot gets abused

1. Automated traffic

A script can open your page and send the bot a message every second. Each reply uses your allowance, and on a usage-billed tool each one can be a charge. The fix is a limit per visitor. A real person reading the answers rarely sends more than a few messages a minute, so a limit set above that stops a script without ever bothering a customer.

Rate limits have a gap worth knowing about. They work per visitor, usually by IP address, so they slow down one source. Traffic spread across many addresses can stay under each limit. That's why the overall cap on your plan matters as much as the per-visitor one.

2. People using your bot as a free general AI

Some visitors will ask a plumber's chatbot to write an essay, translate a contract or fix their code. It's rarely malicious: they found a free AI box and tried it. Every answer still comes out of your allowance, and a screenshot of your bot writing poems doesn't do much for your brand.

The defense is a bot that answers only about your business and politely declines the rest. Test it yourself: ask your own bot for a cover letter and see what it does. If it happily writes one, tighten its instructions or pick a tool that stays on topic by default. My pre-launch test questions include a few off-topic ones for exactly this.

3. Spam through the contact form

A chatbot that hands off to a person usually does it with a form: name, email, message. Every form on the web attracts spam eventually, and this one lands straight in your inbox. Look for a limit on how often one visitor can submit it, and set up an email filter for the obvious junk.

Don't make the form harder for real customers to compensate. A customer who gives up on a fiddly form costs you more than a spam email does.

4. Your widget on someone else's site

Your chatbot's snippet is public: anyone can view your page source and copy it. Pasted onto another site, a widget with no restrictions would answer that site's visitors from your content, out of your allowance. Most tools let you list the domains the bot may run on. Add every domain your site actually uses.

Then ask one more question: is the list checked by the vendor's server, or only by the script in the browser? A copied script can be edited. A check on the server can't be edited by the person copying it.

5. Prompt injection

Visitors who type "ignore your previous instructions" are attempting prompt injection. I covered what they can and can't get from a support bot in Can Visitors Trick Your Website Chatbot?, so I won't repeat it here. The short version: a bot that can only talk, answers only from your content and has no access to orders or payments limits the damage to text.

What is "denial of wallet"?

Denial of wallet is the AI version of a denial-of-service attack. Instead of knocking your site offline, someone sends enough requests to run up your bill.

OWASP, the nonprofit behind the best-known lists of web security risks, covers it under Unbounded Consumption. It's number six (LLM06:2026) in the OWASP Top 10 for LLM Applications 2026, published in August 2026, up from number ten in the 2025 edition. The 2026 entry lists "Denial of Wallet" as one of its example attacks and calls its defining feature "cost asymmetry": the attacker spends almost nothing while the victim pays for the computation. Its recommended defenses include rate limiting and hard spending caps.

For a small business the real question is simpler: does your chatbot bill have a ceiling?

Hard cap or pay per use: what happens to your bill?

How your tool bills decides how much abuse can cost you.

• Per resolution or per outcome. You pay each time the AI settles a conversation. Intercom's Fin AI Agent is $0.99 per outcome, and Intercom counts one when a customer confirms the issue is resolved or doesn't ask for more help after Fin responds (checked October 23, 2026). Ask any per-outcome vendor how it treats spam and bot conversations.
• Credits with top-ups. Your allowance is fixed, but some tools refill it automatically when you run low, and every refill is a charge. Check whether automatic top-ups are on, and turn them off if you'd rather have a fixed bill.
• A hard monthly cap. The price stays the same whatever happens. At the cap something stops, so the question is what stops: the whole bot, or only the AI answers.

I compared these billing models in more detail in Per-Resolution, Credits or Flat Fee?

A hard cap has a cost of its own, and I'd rather say it plainly. If junk traffic eats your allowance, real visitors lose AI answers until the month resets or you upgrade. The cap protects your bill. Rate limits, the allowed-websites list and a bot that stays on topic protect your allowance. You want both.

How ChatBento handles abuse

Since I build it, here's exactly what ChatBento does:

• Per-visitor rate limits. Each visitor IP can send at most 12 chat messages a minute and 60 an hour to a chatbot. A person reading the answers won't get close. A script hits the limit within a minute.
• Contact form limits. The form accepts 5 submissions per 10 minutes from one IP.
• Allowed websites, enforced on the server. If someone copies your snippet onto a site that isn't on your list, the requests are refused.
• It stays on topic. Its built-in rules say to answer only from your content, politely decline questions unrelated to your business, and treat visitor messages as information, not instructions.
• A hard cap and a flat price. At your plan's monthly message limit, the widget shows the contact form instead of AI answers. There's no overage charge and no automatic top-up, so the bill doesn't grow with traffic.

What it doesn't do: stop a determined attack spread across many addresses. Nothing simple does. At the per-minute limit, a single visitor could use up the Free plan's 50 monthly messages in about four minutes, and at the hourly limit could use the Hobby plan's 2,000 in about a day and a half of nonstop sending. If that ever happens, your bill stays the same, visitors still reach you through the contact form, and you'll see the pattern in your conversations.

A checklist for any chatbot

• The bot declines off-topic requests (test it with "write me an essay")
• There's a per-visitor rate limit on chat messages
• The contact form has a submission limit, and your inbox has a spam filter
• The allowed-websites list contains your domains, and it's checked on the server
• You know what happens at your plan's limit: overage, a top-up, the bot going silent, or a contact form
• Automatic top-ups are off unless you chose them
• The bot can't take actions or see customer data
• You skim the conversations weekly for repeated messages, gibberish and "ignore your instructions"

The short version

Assume some of your chatbot's traffic won't be customers, and make sure the worst case is a few wasted messages, not a bill.

Every ChatBento plan, including the free one, has a hard monthly message cap and a flat price. The limits for each plan are on the pricing page.