I have a site which runs phpBB, on this site I have

  • enabled user authentication through email when registering
  • enabled captcha

However I still get spam users every 20 to 30 minutes.

Is there anything I can do to prevent this with the ucp.php file?

I have already loaded a large list of IP addresses yet there are spam users registering all the time.

One thing I can do is I can check the bounce mail to find the username and can pipe bounced mails to a php script and immediately delete that user, but I have not got any bounce back from hotmail or some other email clients.

So this way it will catch hold of a certain percent of spam users but there are still a huge amount of users spamming.

What else can I do to prevent spammers abusing my phpBB site?

  • I think this question belongs on Server Fault.
    – S.L. Barth
    Commented Nov 25, 2011 at 12:52
  • I think it belongs here, it isn't a server issue spam is a webmaster issue.
    – Toby
    Commented Nov 26, 2011 at 22:50

2 Answers 2


a silly thought did the trick.

what i did was just renamed the files which i felt were used frequently and commonly and now there is not even one spammer in the past 15 days.

hehe. oh pity my mind... i have been thinking of other alternatives like keycaptcha and others...

anyway this is temporary i think if the hacker knows what changes i made or if he particularly attacks my site then still the problem exists but for now i am free.

oh my goodness. i dont know what to say.

I did edit the following.

memberlist.php, viewtopic.php, viewforum.php, ucp.php, viewonline.php and feel free to modify what ever files you wish are vulnerable.

  • Great idea, depending on how long it works. To help future readers of this answer, can you edit this to mention which files you had to edit so that legitimate visitors would still be pointed to the correct URL? Commented Dec 15, 2011 at 16:23
  • i have updated my answer as per your request. if i am being attacked again then i will again change my files and will allow redirection from searching engines using htaccess buy conditioning whether bots are accessing those pages. Commented Dec 16, 2011 at 9:51
  • and lately i had been thinking of writing a forum of my own... Commented Sep 11, 2014 at 7:42

The first thing to do is make sure your version is up to date, you can check this in the ACP.

If it is up to date then there are a wealth of anti-spam mods you could install, find which one is the best for you.

Finally something I did (but the setup took some time to get right) was to run my site via CloudFlare which managed to stop a lot of spammy page requests at source.

  • i have updated that and cloudflare said it would take max of 24 hours for the dns to get updated... besides i installed the mod keycaptcha from www.keycaptcha.com . do you have any idea... in the admin it instructed me to update their api key and javascript code when i submitted the form i get 406 not acceptable. Commented Nov 28, 2011 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.