stop register forum spammers

My money would be on a bot of some kind. It's unlikely that anyone would enter 1,000 messages by hand, especially in such a short time, though it's possible that the registration is done manually.

Even so, a Captcha might slow them down enough to make them go elsewhere.

Email me if you'd be interested in a plugin connected to OnDocFormSave that would analyze the content of the messages and keep them from saving.

We are implementing additional techniques for combatting spam including making it harder for bots to register (I will not use reCaptcha as bots cracked it in 2011 and it just makes it hard for humans to register). I will also add a question and answer challenge that will be hard for bots for registrations but will not force new users unfamiliar with MODX to have pre-existing knowledge. All it appears to take to kill bots are q/a that can't be queried via google. This is how they are beating the math. I just need someone to write a hook for it.

In addition, I need to make it so spammer registrations look like they are successful but they do not get the activation emails. If spam bots look like they are successful the script authors will not try to alter the script to make it work.

In addition, we're going to be adding post moderation which will check posts for suspected spam or spammers. This will prevent the posts from getting posted even if the spammers register.

AFAIK, bots have not broken the math equation method if the equation is an image. I could be wrong.

If you can check the content without the sig, I would think this would be useful, especially if applied to users with very few posts:

The equation is not an image in our case. So it's easily queried via Google/GET. We're implementing a forum/comment spam service to combat content spam. It should prevent major spam bombings like we had on Sunday.

The MODX Captcha plugin will generate an equation. Unless I'm misremembering, it's an image.

I came back to the MODX forums after not doing any MODX work for a couple of years (my bad!). I was disappointed to see the Spam posts as quickly as I did — it's hard enough sorting through the posts.

I suspect that filtering the posts themselves is the most effective way to keep the site looking clean. WordPress sites generally use the Akismet plugin. The only drawback to that approach is that it relies on "learning" from many sites (1,000s, 10,000s?) and requires servers to handle the matching.

Bob's proposal to put posts in quarantine if they contain more than a certain number of links might be a good start. [ed. note: jrg last edited this post 12 years ago.]

On one of my sites where I was getting hundreds of bot registrations a day, I added an invitation code. On the registration page I added a line that said 'Please read the terms of use and forum rules found here: (link to terms and rules page here) and enter the invitation code (found at the bottom of the page) here:' The invitation code is a simple, easy to spell word like 'pickle'.

Stops bot and human spammers almost completely. Spammers pay human operators piece rate, the software attempts to register, if it cannot, your site is placed in a que for a human to solve. The software bot cannot figure out how to go to another page and find a word. Humans won't take the time.

I've asked many of the legitimate users if they found this onerous, and all said it was easier than the typical captchas.

WillyP's comments are to the point, this is how bots and human spam posters work exactly.

His option is a good one, you can do a variant of it as well where you simply have an external javascript function write up a css positioned div with the special string printed out. Most bots do not execute javascript so they won't even see it. Make sure to not have any on page html version of this box, it must be pure javascript. Have a noscript text that tells real users on the initial signup page, not the form page itself, that theymust enable javascript, the bots never look at those pages in my experience, or just auto click them, so if you tell users to do something there and not on the target signup page, that works for humans but bots don't see the warning, and thus don't realize they need js.

If you position the popup div right above or next to the text box input you can just say, type in the word, without giving any hint where it is to the bots or humans.

Almost all bot posters come via xrumor, my experience is it's about 99.9% xrumor and the rest are humans from pakistan or various former USSR block countries, ie, low wage areas.

WillP's approach was one I was about to take too before I finally cracked the logic of the autobots, but his step was what I was about to do, plus execute the text in javascript as well, though that's only a temp workaround.

I leave my original captcha stuff up to make the bots feel at home, but I don't really use that to stop them at all, I just like them to feel welcome. [ed. note: lizardx last edited this post 12 years ago.]

By the way, the new google recaptcha is massively improved over the old stuff, which was basically impossible to read for normal humans, the new stuff is much nicer, I added it to quip and was very surprised by how much they have improved it. But it usually only takes bot authors a few days to crack the latest captcha stuff, so that should not be your primary defense for high value targets like forums. I've never really seen this type of focus on blogs myself, though certainly the methods used by badbehavior spam detections work fairly well, but are also easy to program against by simply slowing the bot steps down to closer to human speed. But bad behavior logic is very good, and will catch a large percentage of auto signup/posters as well. Not as many as serious defense, but good.

Other things that work well are things like, what is the topic of this forum, or something like that. Keep in mind that you can never stop humans so don't worry too much about a human who is determined to signup, that's a minority of all attempts, by a huge factor. I get probably 1000 bot user signup attempts per day, I don't know how many, I stopped counting, but out of all those, maybe 1 or 2 a week are humans spammers. I don't care about the humans, they are always predictable and easy to spot because they are always poorly paid wage drones who always do the same exact thing, not clever hackers. the norm is to copy paste something from another post or thread, out of context always, as a first posting, so all you have to do is search the forums for the exact string they used, and if it matches, you know it's a spammer. They do this to avoid first posting spam detections, sometimes I have seen them wait weeks to do the first posting like this. [ed. note: lizardx last edited this post 12 years ago.]

JRG, welcome back to MODX. Unfortunately the timing was bad for you. We have only had two major bot spam attacks since the forums were built, which is relatively decent. I am still awaiting assistance from our busy team to remove the spam posts in the forums that became orphaned when cleaning up bot users accounts.

There are some good ideas here for sure. We are implementing additional checks on users and posts. As the MODX Forums are built using Discuss, and not any other forum software is that any tool that needs to be added will require development, save for things like reCaptcha. Even Akismet would require a moderation 3PC to be built for handling the moderated posts. Sadly this is not something we have a lot of time to work on. We're not neglecting the issue, however and we're making changes (which we'll not publish here) to aid in the prevention of spam.

The MODX forums also share a registration form with the rest of the site. We need to establish any question and answer challenge in a global manner (one that would work site-wide). I have some ideas on that front. Additionally, I need to alter the response spam registrations receive so they don't think that their registration has failed and that we don't prompt them to alter their codebase to handle any changes we've made for it.

We're also improving the spam removal functionality so that when obvious spam accounts are created administrators can handle it quickly and efficiently. This is one major shortcoming we located in Discuss, which left me manually deleting hundreds of posts and flagging hundreds of users by hand.