diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index 076dd228..f62e24e9 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -16,108 +16,6 @@ const waitlistSchema = z.object({
 const CSRF_TOKEN_NAME = "waitlist-csrf";
 const TOKEN_EXPIRY = 60 * 60 * 1000;
 
-function validateBrowserRequest(request: NextRequest): boolean {
-  const origin = request.headers.get("origin");
-  const referer = request.headers.get("referer");
-  const userAgent = request.headers.get("user-agent") || "";
-  const secFetchSite = request.headers.get("sec-fetch-site");
-  const secFetchMode = request.headers.get("sec-fetch-mode");
-  const secFetchDest = request.headers.get("sec-fetch-dest");
-  const contentType = request.headers.get("content-type");
-  const accept = request.headers.get("accept");
-
-  if (env.NODE_ENV === "development") {
-    console.log("=== Validating Browser Request ===");
-    console.log("Origin:", origin);
-    console.log("Referer:", referer);
-    console.log("User-Agent:", userAgent);
-    console.log("Sec-Fetch-Site:", secFetchSite);
-    console.log("Sec-Fetch-Mode:", secFetchMode);
-    console.log("Sec-Fetch-Dest:", secFetchDest);
-    console.log("Content-Type:", contentType);
-    console.log("Accept:", accept);
-  }
-
-  const allowedOrigins =
-    env.NODE_ENV === "development" ? ["http://localhost:3000", "http://127.0.0.1:3000"] : ["https://opencut.app", "https://www.opencut.app"];
-
-  if (!origin || !allowedOrigins.includes(origin)) {
-    console.log("Failed: Invalid origin");
-    return false;
-  }
-
-  if (!referer || !referer.startsWith(origin)) {
-    console.log("Failed: Invalid referer");
-    return false;
-  }
-
-  const suspiciousUserAgents = [
-    "curl",
-    "wget",
-    "postman",
-    "insomnia",
-    "thunder client",
-    "httpie",
-    "python-requests",
-    "node-fetch",
-    "axios",
-    "scrapy",
-    "httpclient",
-    "okhttp",
-    "libwww-perl",
-    "python-urllib",
-    "go-http-client",
-    "java/",
-    "apache-httpclient",
-  ];
-
-  const lowerUserAgent = userAgent.toLowerCase();
-  if (!userAgent || suspiciousUserAgents.some((agent) => lowerUserAgent.includes(agent))) {
-    console.log("Failed: Suspicious user agent");
-    return false;
-  }
-
-  const hasBrowserIndicators =
-    lowerUserAgent.includes("mozilla/") ||
-    lowerUserAgent.includes("chrome/") ||
-    lowerUserAgent.includes("safari/") ||
-    lowerUserAgent.includes("firefox/") ||
-    lowerUserAgent.includes("edge/");
-
-  if (!hasBrowserIndicators) {
-    console.log("Failed: No browser indicators in user agent");
-    return false;
-  }
-
-  if (secFetchSite && secFetchSite !== "same-origin") {
-    console.log("Failed: Invalid Sec-Fetch-Site:", secFetchSite);
-    return false;
-  }
-
-  if (secFetchMode && secFetchMode !== "cors") {
-    console.log("Failed: Invalid Sec-Fetch-Mode:", secFetchMode);
-    return false;
-  }
-
-  if (secFetchDest && secFetchDest !== "empty") {
-    console.log("Failed: Invalid Sec-Fetch-Dest:", secFetchDest);
-    return false;
-  }
-
-  if (!contentType || !contentType.includes("application/json")) {
-    console.log("Failed: Invalid Content-Type");
-    return false;
-  }
-
-  if (!accept || (!accept.includes("application/json") && !accept.includes("*/*"))) {
-    console.log("Failed: Invalid Accept header");
-    return false;
-  }
-
-  console.log("Browser validation passed!");
-  return true;
-}
-
 async function validateCSRFToken(request: NextRequest): Promise<boolean> {
   const clientToken = request.headers.get("x-csrf-token");
   if (!clientToken) return false;
@@ -153,13 +51,6 @@ export async function POST(request: NextRequest) {
   if (!success) {
     return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 });
   }
-
-  if (!validateBrowserRequest(request)) {
-    await new Promise((resolve) => setTimeout(resolve, Math.random() * 2000 + 1000));
-
-    return NextResponse.json({ error: "Invalid request" }, { status: 403 });
-  }
-
   const isValidToken = await validateCSRFToken(request);
   if (!isValidToken) {
     return NextResponse.json({ error: "Invalid security token" }, { status: 403 });