What Makes an Online Voting System Secure?
Published 18 August 2026 · 5 min read · Guide
In short
An online voting system is secure when it enforces vote limits before a vote is stored, verifies voters to a level matching what is at stake, rate-limits repeated requests, keeps a tamper-evident record of every vote with a timestamp, restricts who can change results, and protects voter data. No system prevents every duplicate vote; a secure one makes manipulation expensive enough that it cannot change the outcome, and visible enough to investigate.
"Is it secure?" is the question every committee asks and almost no vendor answers usefully. The honest answer is not a yes — it is a list of specific controls, and an admission of what none of them can do. This guide sets out what to expect from a voting platform, in the order the controls actually matter, so you can tell a real security posture from a padlock icon.
What does security mean for a competition vote?
It means three things, and they are worth separating because platforms often deliver one and imply all three.
- 1Integrity of the count — the total reflects the votes that were validly cast, and cannot be quietly edited
- 2Resistance to manipulation — automated or duplicate voting cannot cheaply change the winner
- 3Protection of voter data — email addresses and payment details are handled lawfully and safely
Note what is absent: ballot secrecy. Competition voting is generally not a secret ballot, and pretending otherwise creates confusion. Voters should know their vote is recorded against an identifier for anti-fraud purposes.
Which controls should every voting platform have?
| Control | What it does | Why it matters |
|---|---|---|
| Server-side rule enforcement | Checks limits before storing a vote | Rules applied only in the browser can be bypassed in seconds |
| Vote limits | Caps votes per person, per day, per email or per account | Bounds how much one person can shift the result |
| Rate limiting and cooldowns | Enforces a pause between votes from one connection | Breaks the economics of scripted voting |
| Identity verification | Ties a vote to an email address or account | Raises the cost of manufacturing voters |
| Audit logging | Stores every vote with a timestamp and source | Lets you investigate a challenge instead of guessing |
| Access control | Restricts who can edit an event or its results | Most result tampering is internal, not external |
| Payment isolation | Credits paid votes only after payment is confirmed | Prevents client-side price tampering |
That last row is less obvious than it looks. If a paid vote is recorded from a request the browser controls, the price in that request can be altered. Paid votes should only ever be credited after the payment provider confirms the payment — which is how the Voorna voting platform records them.
How can organisers tell a real control from marketing?
Ask questions that have specific answers. Vague reassurance is the signal.
- "What exactly happens when someone tries to vote twice?" — you want a described behaviour, not "we prevent that"
- "Are limits enforced on the server or in the browser?" — only one of those answers is a control
- "Can I see a record of individual votes with timestamps?" — if not, you cannot answer a challenge
- "Who on your side can change a vote total, and is it logged?" — internal access is a real risk
- "What happens to voter email addresses after the event?" — retention is a privacy obligation, not a detail
What threats do voting pages actually face?
Rarely anything exotic. The overwhelming majority of manipulation is volume, not sophistication:
- Scripted voting — a simple program submitting votes repeatedly. OWASP catalogues this as OAT-016, "Skewing": automated repeated requests intended to alter a metric such as poll results.
- Address rotation — the same person voting through many network connections or proxies
- Disposable email addresses — bulk-created inboxes used to pass email verification
- Coordinated group voting — organised, human, and usually within the rules unless the rules say otherwise
- Insider changes — an organiser or contractor adjusting totals
The scale of the automated portion is not speculative: Imperva's 2025 Bad Bot Report found automated traffic overtook human activity for the first time in a decade, at 51% of all web traffic. Detection is covered in how to detect fake votes and voting fraud; prevention in how to prevent online voting fraud.
What about voter data and privacy?
If you collect email addresses, you are handling personal information, and that carries obligations wherever your voters are. In New Zealand the Privacy Act 2020 sets out thirteen information privacy principles covering collection, purpose, security and disclosure. Australia has the Australian Privacy Principles under the Privacy Act 1988. The United Kingdom applies UK GDPR, and several US states have their own privacy statutes.
Practically, this means: collect only what the vote needs, say on the voting page what you will do with it, do not repurpose voter emails as a marketing list without consent, and delete what you no longer need. If voters may be under 13, additional rules apply — see online voting for school competitions.
What can organisers do that no platform can do for them?
- 1Publish the rules before voting opens, including the vote limit and closing time
- 2State plainly that automated voting will be removed, and what happens if it is found
- 3Keep the number of people who can edit the event as small as possible
- 4Watch the shape of the vote curve during the campaign, not just the totals
- 5Decide in advance who adjudicates a challenge, and on what evidence
- 6Announce the result with the total vote count, so the scale is visible
Security ends up being half technical and half procedural. The platform enforces the rules; you have to have written them.
Frequently asked questions
- Can someone hack an online vote?
- The realistic threat is not breaking into a system but submitting large numbers of votes through the front door — automated requests, rotated addresses or disposable emails. That is why vote limits, rate limiting and verification matter more to a competition than any claim about encryption.
- Does HTTPS make a voting page secure?
- HTTPS protects data in transit between a voter and the site, and every voting page should use it — but it does nothing about duplicate or automated voting. A padlock in the address bar is a baseline, not a security posture.
- Should I use CAPTCHA on a voting page?
- It raises the cost of casual scripting and can be worth it for high-stakes votes, but it also adds friction for every legitimate voter and creates accessibility problems if implemented poorly. For most competitions, server-side vote limits, cooldowns and email verification do more for less cost to turnout.
- How do I prove the result was fair if someone challenges it?
- With published rules and a stored vote record. Being able to show when votes arrived, in what pattern, and that the same limits applied to every entrant answers most challenges. If your platform cannot show you individual vote records with timestamps, you have nothing to show.
Sources
- OAT-016 Skewing — OWASP Foundation. The definition of automated repeated voting intended to alter poll results as a catalogued application threat.
- 2025 Bad Bot Report — Imperva (Thales). Automated traffic reaching 51% of web traffic and overtaking human activity.
- Privacy Act 2020 — New Zealand Legislation. New Zealand's thirteen information privacy principles governing collection, security and disclosure of personal information.
- Australian Privacy Principles — Office of the Australian Information Commissioner (OAIC). The privacy framework applying to organisations handling personal information in Australia.
Want to see the controls rather than read about them? Voorna enforces vote limits, cooldowns and verification before a vote is ever recorded.
Explore Voorna's voting controls