Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a site which runs phpBB, on this site I have

  • enabled user authentication through email when registering
  • enabled captcha

However I still get spam users every 20 to 30 minutes.

Is there anything I can do to prevent this with the ucp.php file?

I have already loaded a large list of IP addresses yet there are spam users registering all the time.

One thing I can do is I can check the bounce mail to find the username and can pipe bounced mails to a php script and immediately delete that user, but I have not got any bounce back from hotmail or some other email clients.

So this way it will catch hold of a certain percent of spam users but there are still a huge amount of users spamming.

What else can I do to prevent spammers abusing my phpBB site?

share|improve this question

migrated from stackoverflow.com Nov 26 '11 at 1:40

This question came from our site for professional and enthusiast programmers.

    
I think this question belongs on Server Fault. –  S.L. Barth Nov 25 '11 at 12:52
    
I think it belongs here, it isn't a server issue spam is a webmaster issue. –  Toby Nov 26 '11 at 22:50
add comment

2 Answers 2

The first thing to do is make sure your version is up to date, you can check this in the ACP.

If it is up to date then there are a wealth of anti-spam mods you could install, find which one is the best for you.

Finally something I did (but the setup took some time to get right) was to run my site via CloudFlare which managed to stop a lot of spammy page requests at source.

share|improve this answer
    
i have updated that and cloudflare said it would take max of 24 hours for the dns to get updated... besides i installed the mod keycaptcha from www.keycaptcha.com . do you have any idea... in the admin it instructed me to update their api key and javascript code when i submitted the form i get 406 not acceptable. –  Jayapal Chandran Nov 28 '11 at 12:16
add comment
up vote 2 down vote accepted

a silly thought did the trick.

what i did was just renamed the files which i felt were used frequently and commonly and now there is not even one spammer in the past 15 days.

hehe. oh pity my mind... i have been thinking of other alternatives like keycaptcha and others...

anyway this is temporary i think if the hacker knows what changes i made or if he particularly attacks my site then still the problem exists but for now i am free.

oh my goodness. i dont know what to say.

I did edit the following.

memberlist.php, viewtopic.php, viewforum.php, ucp.php, viewonline.php and feel free to modify what ever files you wish are vulnerable.

share|improve this answer
    
Great idea, depending on how long it works. To help future readers of this answer, can you edit this to mention which files you had to edit so that legitimate visitors would still be pointed to the correct URL? –  joshuahedlund Dec 15 '11 at 16:23
    
i have updated my answer as per your request. if i am being attacked again then i will again change my files and will allow redirection from searching engines using htaccess buy conditioning whether bots are accessing those pages. –  Jayapal Chandran Dec 16 '11 at 9:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.