Hot answers tagged

12

Yes, fake accounts are bad for your site. They could significantly hurt your site's reputation. When they register, your site probably sends an email to a bad address or an address that belongs to someone that didn't register on your site. That makes you look like a possible spammer. They could use the accounts to degrade performance on your site (this is ...


9

When an online account's password is compromised, the hackers will sometimes sign the victim up for accounts on a ton of other online services. They hope that their actual nefarious activities are lost in the flood of confirmation emails. Mailchimp says this on the subject: Sometimes, when an abuser attempts to takeover an account, they'll sign their target ...


4

The answer is to not use a captcha, or use something in addition to it. Look to alternate methods such as hidden form fields that should never be filled in. Bots will most likely still fill them in, your validation will know immediately that it is a spammer. Another method would be the time based trigger. If a bot hits page then fills out a form, it will be ...


4

The bots are probably harmless. But I like to think that I'm starring in a Tom Clancy novel and it's a sleeper cell waiting to unleash a tidal wave of spam that could ultimately compromise national security. So I recommend deleting them on a routine basis. ;) When a user signs up, determine what country they're from. I find that MaxMind's GeoIP web service ...


3

Adding a captcha check before directing the user to the next section of your site will more than likely prevent the Googlebot from continuing. I say more than likely as Google provides reCaptcha and MAY have implemented a bypass to allow the Googlebot to access resources protected by reCaptcha, however this is unlikely. The best way to ensure access is to ...


2

I would be tempted to email anyone who has signed up and not posted to ask them if they are having trouble - good customer service! - and if their email addresses bounce, or they respond with junk then delete their accounts. I +1 mikey_w because on a reasonable size discussion forum (1,000+ posts a day) I have worked with, I do indeed find that spam bots ...


2

I have this on some of my sites, whilst not a perfect solution I used MaxMInd GeoIP to block countires in Eastern Europe & China. This reduced the number of bad signups by over 90% for me. GeoIPEnable On GeoIPDBFile /path/to/GeoIP.dat SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry # ... place more countries ...


2

My guess would be that they're crawlers which haven't received a particular order to sign up for your site, just sites in general. I can't imagine why they would sign up and then never post anything; perhaps your post button/form is oddly set up so that they can't use it? If you want to prevent them from registering (the ones which get past the captcha), you ...


2

Sign up for a api key it's free. And use the following code example. https://github.com/google/recaptcha/tree/master/examples


2

No it can't. The whole purpose of reCAPTCHA is to verify that the connection is being controlled by a human and not a machine. If there is content behind the reCAPTCHA protected form that you want Google to index then you need to identify another way for Google to be able to look at it (like giving Google authentication information to bypass the CAPTCHA) ...


1

Your list of questions appears to limited. An attacker just has to make a list of the questions that you use. A good captcha would never ask the exact same question to two people. Your questions are going to turn away users. This is a bunch of work to fill out. A sizable percent of users are going to give up when they are faced with this much work. ...


1

It depends whether your potentially vulnerable pages are indexable by search engines and accessible directly. If they are and they don't redirect user to your initial Captcha check, Then the answer is yes, you would need to implement Captcha or redirect to your "initial" Captcha check on every potentially vulnerable page if user has not already passed the ...


1

Google has a translate API https://cloud.google.com/translate which has a free component and then becomes a paid service. First 500,000 characters per month = Free (applied as $10 credit every month) 500,000 to 1 billion characters per month = $20 per million characters Over 1 billion characters per month = Contact a sales representative to discuss discount ...


1

Go into your Cloudflare dashboard and check you're Under Attack mode. If it is on, turn it off. You should also check your page rules


1

If they are both using the same domain, I doubt it is possible to create a second set of keys. I know this is an old question, but did you try it? I suspect you will get some sort of duplicate error. If you did come up with an answer to your own question, please post it here so the information is available for future users.


1

Google retired distortion words awhile back since it only takes bots a few milliseconds to crack them wide open. reCAPTCHA by Google has a few settings for example: So, option 2 invisible would be suitable but again this would be signs, cars, and storefront based questions, text no longer exists. It should be mentioned that bots are still able to crack ...


1

depends... I'm quite sure Googlebot doesn't trigger the challenge if you use invisible reCaptcha. We have file downloads that require generating a download token, and Google successfully generates these tokens constantly. (so it must be bypassing the invisible reCaptcha)


1

The nice thing with captcha is that the expected answer is a randomly displayed answer inside an image. This is golden because the hacker wouldn't figure out the value since upon a simple page reload, the expected answer is (or at least should be) different. If you use a question and answer format, then it might be easier for a hacker to guess because the ...


1

If you enable ConfirmAccount, you don't need CAPTCHAs for account creation any longer. Just drop ConfirmEdit, if your wiki becomes closed access.


1

Are there better solutions to this problem other than adding more human moderators? yes, automated annoyance of the spammers and their commercial objectives. First, make sure all past and future links on your site are "nofollow" see here for full details https://en.wikipedia.org/wiki/Nofollow but basically it makes your site far less attractive to ...


Only top voted, non community-wiki answers of a minimum length are eligible