Auto-apply on HH.ru in 2026: how to do it safely without getting banned

Eighteen months ago we tested the first version of auto-apply on HH.ru — Russia's biggest job board. The algorithm was simple: open the search filter, walk the list, click apply, click apply, click apply. Sixty to seventy applications a day. Three weeks in, the test profile caught a shadow-ban. The dashboard showed applications "sent," but they never reached the recruiters' inbox. We only figured it out when several real users wrote in with the same behavior.

We rewrote the logic from scratch three times since. Today the system handles up to 200 applications per day on the top tier without bans. The main thing we learned across all those iterations: HH.ru doesn't ban for volume, it bans for pattern.

This article is the distilled production knowledge from running auto-apply for over a year. No "1000 applications per day" marketing fiction.

Why HH.ru bans applications in the first place

Technically nothing in their TOS bans frequent applying. There's no "max N per day" limit written down. But the anti-bot system runs 24/7, and it has two reasons to exist.

Recruiter spam protection. Recruiters pay HH for subscriptions and contact reveals. If their inbox fills with 200 identical applications a day, they stop using the platform. HH cares because revenue comes from companies, not candidates.

Reputation defense. HH positions itself as a professional platform, not a Craigslist clone. Bots break that illusion.

So the system doesn't ban for "too many," it bans for "doesn't look like a human." Below — what specifically.

Three ban types on HH.ru

Not all bans are the same. From our production data there are three levels — light warning to full account freeze.

Soft-ban: applications don't deliver. The most common one. Your dashboard shows "sent," but the application lands in a "possibly spam" folder on the recruiter side, or doesn't show up at all. Profile stays active, you can keep applying — just for nothing. Usually lifts after 7-21 days if behavior normalizes.

Shadow-ban: invisible bury. The nastiest. Applications technically reach the recruiter, but HH's algorithm pushes your profile to the bottom of the candidate ranking. Recruiters never see you because they only browse the first 30-50 candidates. Lasts months. The "fix" is usually creating a new profile with a different email.

Hard-ban: account freeze. You log in and see "your account is temporarily restricted, please contact support." Lifted after a support ticket explaining your situation (the standard "I just got laid off and I'm actively looking" usually works). 3 days to 3 weeks resolution.

The worst one is shadow-ban. It's invisible from the inside, doesn't change your dashboard at all, and you only realize it from the fact that nothing's coming back. Most "I applied on HH for three months, zero responses" stories are this one specifically.

What actually triggers the anti-bot

These are the signals HH collects and weighs. Not public — we reverse-engineered them by watching system response to our changes over months.

1. Hourly concentration. A burst from 9:00 to 9:30 with 30 applications — red flag. A real candidate works differently: 1-3 applications, pause, 1-2 more, pause. The anti-bot counts density and compares it to typical human distribution.

2. Time between applications. If intervals are measured in seconds — the detector sees it. A real person opens the listing, reads, drafts a cover letter — that takes noticeable time.

3. Cover letters. Identical "Hi, interested in your role" — caught instantly. Same template with company-name substitution — also caught. HH hashes the text and counts repeats.

4. Time on the listing page. If you have 80 applications today but zero visits to the listing pages, the algorithm knows you're applying without reading. A real candidate opens the page, reads, then clicks apply.

5. Browser fingerprint. Headless Chrome without emulation gets caught on fingerprinting in minutes. Cheap automation typically dies at this step.

6. IP address. One IP with thousands of applications usually means a datacenter VPN. HH knows the IP ranges of popular hosting providers and weights them as suspicious.

7. Fresh account + bulk applying. Registration → 50 applications same day = instant hard-ban. Real new users apply 3-5 times in their first week, then warm up gradually.

Safe volume guardrails

If you're going manual or thinking of writing your own script, these are the thresholds to keep in mind:

• Account without history — first 7 days no more than 5 applications/day, then a gradual ramp-up. HH knows their fresh-user analytics, and aggressive activity early gives away automation immediately.
• Daily ceiling without extra layers — roughly 30-50 applications per profile with established history. Going higher requires additional behavioral emulation, otherwise shadow-ban probability rises non-linearly.
• Time concentration — even distribution through the day matters more than the total. A burst of 30 applications between 9:00 and 9:30 is more dangerous than 80 spread evenly over the working day.
• Night hours — applications between 2:00 and 7:00 Moscow time are themselves a red flag, since real candidates are barely active then.

The "1000 applications per day" some competitors advertise is either marketing fiction or distribution across multiple separate profiles from different IPs. The latter is technically possible, but HH sees a common browser fingerprint and activity history — most such farms get caught within 2-3 weeks.

Doing it manually (no bot)

If you want to skip automation entirely, here's a safe rhythm for manual applications:

1. Open the search list with filters set (salary, remote, stack) — no more than 7-8 filter parameters, otherwise the pool narrows to ten roles and HH starts noticing you have a very narrow target.
2. Click into a specific listing. Read the description — actually read, don't just scroll. HH tracks time on page.
3. Apply with a unique cover letter. 3-4 sentences, mention at least one specific detail from the listing. Disarms HH's tracking and gets better recruiter response.
4. No more than 5-7 applications back-to-back. Take a 30-60 minute break.
5. Daily target 25-30 applications. 50 is the ceiling. 30 thoughtful applications beat 80 templated ones.

This eats 2-3 hours per day. If you have those 2-3 hours for a month, great — stay manual. Most people burn out on it within two weeks and switch to automation.

How it works inside JobPath

Auto-apply runs on three tiers: Free — 15 applications/day, Basic at $9/month — 50/day, Premium at $19/month — up to 200/day. Each tier is configured for its risk profile.

What's under the hood, without the implementation specifics we don't disclose for obvious reasons:

Daily limits as part of safety, not a knob. Not a setting you can override — a hard ceiling. Lower on smaller plans because aggressive activity is most dangerous on fresh profiles. Higher on Premium — but only because there are several layers of protection inside that make it safe.

AI-generated cover letters for each listing. Input — the role description plus your resume. Output — 3-4 sentences specific to that role. Not a template with company name substitution. Every letter is unique in content.

Behavioral model that imitates a real candidate. We don't disclose the details, because any public recipe gets cloned by competitors within a week. By result: customer profiles on average don't catch shadow-bans even at full Premium volume.

Anti-detect infrastructure per profile. IP, environment, activity pattern — different per user. No common fingerprint that one detection sweep can catch.

Auto-pause at the first sign of anomalies. If HH starts returning unexpected responses or slowing down, the campaign pauses pending investigation, and the user gets notified. This has saved over a hundred profiles in the last year.

16 filter parameters. Salary, location, work format, stack, experience, company size, international roles yes/no, business domain, and so on. Narrow filters aren't about UX polish — they prevent 50 templated applications to irrelevant roles (which is itself an anti-bot trigger).

The dashboard shows how many a campaign sent, how many got filtered out, how many errored, and when it was last active. No black box — real numbers in real time.

What to do if you're already banned

Soft-ban. Don't panic, don't write to support. Stop auto-apply, switch to 5-10 manual applications per day for 7-14 days. The ban lifts itself.

Shadow-ban. Harder. If your applications go into a void for 4-6 weeks (zero recruiter responses), it's most likely this. The fix: create a new profile under a different email, rewrite your resume (different phrasing, not a copy-paste), keep the old profile alive with minimal activity in the background. Migrate your recruiter contacts manually — that's about two months of work.

Hard-ban. File a support ticket. Text: "Actively job-hunting after a layoff, sent many applications. Please unblock. Will follow the rules." Response in 1-3 business days. From our experience the first ticket almost always succeeds. The second one might not.

What to try

If you've been job-hunting for a while, spend two hours a day on manual applications, and want that time back — JobPath does it for you. Free tier gives 15 applications/day — enough to test the dashboard and compare to manual mode. Basic at $9/mo — 50/day, fits a classic active search. Premium at $19/mo — up to 200/day, for people running parallel tracks (Backend + DevOps + ML, each as a separate campaign).

Hit jobpath.world to see what filters are available and how the dashboard looks — takes a couple of minutes.

If you have a self-written script — check it against the seven-factor list above. If three or more of the triggers apply to you, your profile is walking a shadow-ban tightrope. Rewrite the algorithm.

If you apply by hand — keep applying by hand. Stay under 30-40/day and don't stress. Safest of all, slowest of all.

The single rule: HH.ru bans for pattern, not for volume. Imitate a human and you walk freely. Imitate a bot and you get banned. There are no other secrets.