Waiting room and queue fairness for online sales: controls that keep real buyers in line

One person, one place is the whole game

Every queue exploit is a way to hold more than one place or to take a place earlier than others. Multiple browser sessions, automated token requests, and shared queue links all multiply places. Controls that bind a queue token to a device and session, limit tokens per network, and invalidate tokens passed around publicly reduce multiplication without asking honest buyers to do anything unusual.

Be careful with blunt network limits. Households, offices, and mobile networks share addresses, so a hard limit per address will block families buying separately. Use network signals as one input among several, and step up checks rather than refusing entry when signals conflict. The goal is to make farming expensive, not to make ordinary shared connections suspicious.

Admit at the rate the store can serve

A queue that admits buyers faster than checkout, inventory, or payment can handle simply moves the crash downstream and rewards the fastest scripts at the till. Set admission from real capacity: successful checkouts per minute, not page views. Hold the rate steady and publish an honest estimate of waiting time, updated as the rate changes.

Protect the endpoints behind the queue as carefully as the queue itself. If product, stock, or checkout addresses can be reached without a valid queue token, the queue is theatre. Test direct access before every major sale, including older campaign links and app deep links that might bypass the waiting room entirely.

Abandoned places and refresh behaviour

Real buyers drop out, get distracted, and lose connections. Queue places should expire after a short period of inactivity, returning capacity to the line, but a single page refresh should not send a genuine buyer to the back. A grace window that restores a place on the same device preserves fairness in both directions: no hoarding by idle sessions, no punishment for a dropped connection.

Watch for refresh farming, where scripts cycle sessions to collect tokens and keep the freshest. Token issuance rate per device and network, and the pattern of tokens created but never used, are useful signals. A sale where a large share of queue tokens never browse is a sale where farming probably happened, even if the site stayed up.

Communicate like the queue is part of the product

Buyers forgive waiting when they know the rules: when the sale opens, how places were allocated, whether refreshing loses a place, and what happens when stock runs out while they wait. Put those answers on the waiting page itself, in plain language, and update the page when something changes during the sale.

Afterwards, publish a short fairness summary for contested sales: places issued, admissions, sell out time, and actions taken against automation. Stores that explain their queue earn trust for the next launch. Stores that say nothing leave the explanation to frustrated buyers and the resellers who beat them.

Keep reading: Gift card fraud bots: how balance checking attacks work and how to slow them, Sale day bot spikes: preparing a store for launch traffic that is half human, half automated, and API abuse bots: why your mobile and checkout APIs get attacked even when the website looks fine cover the nearby cases in this series.

Frequently asked questions