How Does Secure Online Voting Work?
Published 18 August 2026 · 6 min read · Explainer
In short
Secure online voting works by validating every vote on the platform's own servers before storing it. When someone taps a vote button, the platform checks that voting is open, that the entrant is valid, that the voter has not exceeded their limit, and that the request is not arriving faster than the rate limit allows. Only then is the vote written to a permanent record with a timestamp, and the running total updated.
Most explanations of voting security list features. This one follows a single vote through the system, because the sequence is where security actually lives — specifically, in what gets checked before anything is written down. Understanding the sequence makes it obvious why some platforms hold up under pressure and others produce a total nobody can defend.
What happens when someone casts a vote?
A single tap triggers a chain of checks. Each one can reject the vote, and the order matters.
- 1The request arrives at the server. The browser sends the entrant's identifier; it does not send the result. Nothing the browser claims is trusted.
- 2Event state is checked. Is this event active, and is voting still open? A vote arriving one second after the close is rejected here.
- 3Voting mode is checked. If the event only accepts paid votes, a free vote is rejected before anything else happens.
- 4The entrant is validated. Does this entrant exist in this event, and are they still accepting votes? A withdrawn or disqualified entrant rejects here.
- 5Rate limits are applied. Has a vote arrived from this source within the cooldown period? Has this source exceeded its daily cap?
- 6Duplicate rules are applied. Depending on configuration: has this source already voted for this entrant today, has this email already voted, has this account already voted?
- 7The vote is written. Only now is a permanent record created with a timestamp, source and any attribution.
- 8The total is updated. The visible count moves.
Steps two through six all happen before step seven. A platform that writes the vote first and validates afterwards has already lost — because a rejected vote that was briefly counted is visible, and reversing it looks like tampering.
Why does server-side enforcement matter so much?
Because anything enforced in the browser is enforced by the attacker. A vote limit implemented as a disabled button, a cookie or a value in local storage is bypassed by clearing storage, opening a private window, or sending the request directly without a browser at all.
The distinction is not academic. It determines whether stopping duplicate voting requires technical skill or none. Automated voting is common enough that OWASP catalogues it as OAT-016, "Skewing" — repeated automated requests intended to alter a metric such as poll results — and Imperva's 2025 Bad Bot Report found automated traffic accounted for 51% of all web traffic. Client-side limits do not survive contact with any of that.
How does a platform recognise the same voter twice?
It uses signals of increasing strength, each with a cost.
| Signal | Strength | Bypassed by | Cost to voters |
|---|---|---|---|
| Browser storage or cookie | Very weak | Private browsing; clearing storage | None |
| Network address | Moderate | Mobile data switching, VPNs, proxies | Shared networks may be blocked |
| Verified email address | Good | Disposable email services | One extra step |
| Account sign-in | Strong | Creating multiple accounts | Significant drop-off |
| Confirmed payment | Strong | Spending more money | Excludes those who cannot pay |
No single row is sufficient, which is why platforms combine them. A network address check with a short cooldown and a daily cap costs legitimate voters nothing while making high-volume automation slow and visible; email verification then raises the cost of manufacturing voters. Voorna combines the first three: an organiser-set free-vote limit, plus a cooldown and a daily cap per network connection, applied on every free vote before it is stored.
How are paid votes handled securely?
This is where voting platforms most often have a genuine vulnerability, and it is worth understanding precisely.
If a paid vote is recorded directly from a request the browser controls, then the price in that request is under the voter's control too. Anyone who opens developer tools can alter it and buy a hundred votes for the price of one. The fix is architectural rather than defensive: paid votes must be credited only after the payment provider confirms the payment, through a server-to-server notification the browser never touches.
Voorna works this way — a purchase is started through a checkout endpoint and the votes are credited when the payment provider confirms the payment, not from the client request that began it.
What is recorded, and why does it matter?
Each stored vote typically records the event, the entrant, whether it was free or paid, how many votes it represents, the source it arrived from, any share link it was attributed to, and the exact time.
That record is what makes a result defensible. Without it, a challenge to a total can only be met with assertion. With it, you can show when votes arrived, in what pattern, and that the same rules applied to every entrant. It is also what makes anomaly detection possible at all — see how to detect fake votes and voting fraud.
The record is personal information, so retain it only as long as you need it and say on the voting page what you collect.
What does secure online voting not do?
- It does not guarantee one human, one vote. A determined person with multiple devices, connections and email addresses can vote more than once.
- It does not provide a secret ballot. Votes are recorded against identifiers for anti-fraud purposes, which is incompatible with genuine ballot secrecy.
- It does not make a vote suitable for a statutory election. In 2020 CISA, the U.S. Election Assistance Commission, the FBI and NIST assessed electronic ballot return as high-risk and recommended paper ballot return.
- It does not replace published rules. The platform enforces the limit; you have to have chosen and published one.
The goal for a competition is proportionate: make manipulation expensive enough that it cannot change the outcome, and visible enough that it can be investigated. The organiser-facing view of these controls is in what makes an online voting system secure.
Frequently asked questions
- Are online votes encrypted?
- Traffic between the voter and the site should always be encrypted with HTTPS, and stored data should be protected at rest. But encryption addresses interception, not duplicate or automated voting — which is the actual threat to a competition. Treat HTTPS as a baseline rather than as a security answer.
- Can a voting platform tell a bot from a person?
- Not with certainty. What it can do is make automation slow and conspicuous through cooldowns and caps, raise the cost of fake identities through verification, and record enough detail that automated patterns are visible afterwards. Detection is largely a matter of pattern rather than of identification at the moment of voting.
- What stops the organiser changing the result?
- Restricted administrative access and logging. This is a real risk in volunteer-run competitions, where administrators are frequently connected to entrants. Ask any platform who on their side can alter a total and whether that action is recorded.
- Is a vote counted immediately?
- For free voting, yes — the vote is validated and written in the same request, so the total moves at once. For paid voting, votes should be credited only once the payment provider confirms payment, so there can be a short delay between purchase and the count updating.
Sources
- OAT-016 Skewing — OWASP Foundation. The classification of automated repeated requests intended to alter metrics such as poll results.
- 2025 Bad Bot Report — Imperva (Thales). Automated traffic reaching 51% of all web traffic, overtaking human activity.
- Risk Management for Electronic Ballot Delivery, Marking, and Return — CISA, U.S. EAC, FBI and NIST. The high-risk assessment of electronic ballot return for government elections.
Want to see the mechanics rather than read about them? Voorna's API documentation shows exactly how votes are submitted and validated.
Read the Voorna API docs