We have deployed beta version of our web page (Django) on Digital Ocean VPS. The problem is that week ago started fake registrations, there are mostly from Yandex and mail.ru - russian servers.

We don't promote this page nor it has domain name.

What would you do? Do we need a captcha for this?

  • Read up on web security. Seriously. If you left your registration form vulnerable like that, your web "products" will just spread spam to everyone's dismay. The mail addresses don't mean anything, they are just popular free webmail services. What matters is that you left the website vulnerable without thinking twice. While you are at adding a simple captcha, make sure you escape strings entered by users, don't display mail addresses anywhere and that your admin credentials are strong. Chances are all of those things are wrong. – Zdenek Mar 25 '17 at 16:03

You can do a lot of things. What works for you is dependent on your situation.

  • Live with it.

  • In a dev version, having IP restrictions and/or additional HTTP auth might be perfectly acceptable. This could even work in production in some cases.

  • You could try to alter your login/registration process so that it doesn't look like a standard (Django) login process for scanners anymore.

  • In the same direction, you can alter the login/registration process with a very lightweight "captcha" by just adding another input field that is non-standard and can't be answered by the bots without being adapted to your site. Something like "What's the color of grass?" can be astonishingly effective as long as you have a relatively unknown site that doesn't get targeted directly.

  • Using a captcha. Unfortunately, most captchas are broken and for a good one you end up feeding your visitor data to Google.

  • Some combination of the above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.