If you want to have ngrok as a free public service, then abuse will be hard to get around while keeping it fully featured. However, to preserve the initial user

If you want to have ngrok as a free public service, then abuse will be hard to get around while keeping it fully featured. However, to preserve the initial user experience you could allow the first 5 IP addresses to access the tunnel of unvalidated accounts. This should let them experience the full benefits themselves and/or with their friends or a few remote services and can keep using it with only those first 5 IP addresses. Afterwards, they can jump through extra hoops to remove restrictions. For example: * Free plan: keep using it with up to 5 IP addresses. Rate limited to 512 Kbps total. * Lite plan: register by having us send you an SMS. Unlocks up to 10 different subnets (allows the entire /24 or /16 etc. network block based on whois lookup). * Home plan: pay us $X and remove all IP restrictions. Up to 5 simultaneous connections at 512 Kbps per connection. * Professional plan: pay us $Y and remove all IP restrictions. Up to 15 simultaneous open connections at 1.5 Mbps each. * Enterprise plan: need something custom? We're happy to put together a quote. This limits your exposure to abuse to the first 5 visitors without degrading the experience. Once that threshold is hit, you can response with a "429 Too Many Requests" type of server response, with a link to more info. You could also let users expire IP addresses/subnets, freeing up new connections from new IPs (with appropriate rate limiting). Successive levels of hoops, both free and financial, unlock additional benefits for those who want to pay for them.