BuddyPress.org

@TedMann I think someone more knowledgeable about things .htaccess could better answer that question. I’m really still learning about all this stuff myself. About your other idea though… now that could be brilliantly simple! It could sure put one heck of a damper on the efforts of human sploggers who are, if their activities are any [...]

@pcwriter It’s weird. I tried a proxy server, and was still able to get to the signup page by typing in the url, which leads me to believe the htaccess change isn’t taking right. Is there anything that could be interfering? I had another anti-spam idea: Would there be a way to require a user to [...]

@TedMann If you’re using the same machine that you normally use to access that page, it’s highly unlikely that you get redirected, ‘cuz as site admin, your IP has already been “goldlisted” and you’re known as one of the good guys. To really test if it’s working properly, and there’s no reason it shouldn’t be, try [...]

So, I have a question re: the htaccess tweak to block spam registrations. If I type http://mybuddypressite.com/wp-signup into my browser, I should get automatically redirected to my GOAWAY page, right? If that’s not happening, am I doing something wrong?

Thank you so much, @pcwriter
I’ve been using IP banning now for two days, and that has virtually eliminated most spam signups. Much as I hate to go that route, it’s great to have something that finally works. Will make the htaccess and wp-config changes today, too. Thanks again.

@TedMann This is what I’ve added to .htaccess to block bots: # IF THE UA STARTS WITH THESE RewriteCond %{HTTP_USER_AGENT} ^(aesop_com_spiderman|alexibot|backweb|bandit|batchftp|bigfoot) RewriteCond %{HTTP_USER_AGENT} ^(black.?hole|blackwidow|blowfish|botalot|buddy|builtbottough|bullseye) RewriteCond %{HTTP_USER_AGENT} ^(cheesebot|cherrypicker|chinaclaw|collector|copier|copyrightcheck) RewriteCond %{HTTP_USER_AGENT} ^(cosmos|crescent|curl|custo|da|diibot|disco|dittospyder|dragonfly) RewriteCond %{HTTP_USER_AGENT} ^(drip|easydl|ebingbong|ecatch|eirgrabber|emailcollector|emailsiphon) RewriteCond %{HTTP_USER_AGENT} ^(emailwolf|erocrawler|exabot|eyenetie|filehound|flashget|flunky) RewriteCond %{HTTP_USER_AGENT} ^(frontpage|getright|getweb|go.?zilla|go-ahead-got-it|gotit|grabnet) RewriteCond %{HTTP_USER_AGENT} ^(grafula|harvest|hloader|hmview|httplib|httrack|humanlinks|ilsebot) RewriteCond %{HTTP_USER_AGENT} ^(infonavirobot|infotekies|intelliseek|interget|iria|jennybot|jetcar) RewriteCond %{HTTP_USER_AGENT} ^(joc|justview|jyxobot|kenjin|keyword|larbin|leechftp|lexibot|lftp|libweb) RewriteCond %{HTTP_USER_AGENT} ^(likse|linkscan|linkwalker|lnspiderguy|lwp|magnet|mag-net|markwatch) RewriteCond %{HTTP_USER_AGENT} ^(mata.?hari|memo|microsoft.?url|midown.?tool|miixpc|mirror|missigua) RewriteCond %{HTTP_USER_AGENT} [...]

@pcwriter, you rock. Going to try all of these. Few quick q’s: 1. With the list of bad blocks, you added all these to your HT access file? Is there any downside to having such a lengthy htaccess? Could you anonymize yours and post it? 2. What does “Added “deny from all” in .htaccess for wp-config.php” [...]

I’m using a custom child theme, so the footer copy has been changed. At the risk of inviting more spam, here’s my signup page: http://injersey.com/join-injersey I’ve got si-captcha, Humanity, alternate slug, htaccess tweak, and 2 required profile fields. At this point it’s just getting kind of absurd. There must be some kind of backdoor that’s [...]

@tedmann when I had the rogue bbpress register file and I was getting spammers sign up I could identify them because under ‘users’ they were listed only as users of their subsites rather than my main site – (which I dont believe is possible through legitimate registration?) However, last night I had another such registration. Granted, [...]

@tedmann – and changed the default text on the register page?

@tedmann have you added all the tricks mentioned? changed footer links? added referer rule to your .htaccess

I deleted the registration.php file (and have the alternate slug). Still getting slammed with spam signups and posts. Switching to the si-captcha plugin (though I suspect that won’t do anything since the spammers are bypassing the reg form). Any other ideas?

@tedmann – have a search on your install for the bbPress folder and remove the register.php file. I guess it doesn’t have to be activated for the file still to be there and therefore usable by the spammers.

It worked like a treat for myself and @footybible

I’ve got the Humanity plugin running on our site, with a semi-difficult question. Likewise, I’ve done the htaccess trick, register slug, and so on. Haven’t blocked CURL requests (how do you do that?). I never configured bbpress for our site. Even if I haven’t done that, is it possible that register.php file is still lurking [...]

@tedmann – there was a register file kicking around in the bbPress forum files, and I think that was the back door into the BuddyPress system. I don’t know if that issue has been addressed in the latest BuddyPress / bbPress releases. We stopped spam registrations almost completely on Hello Eco Living by removing the register [...]

Here’s what I don’t understand: All our recent Spam registrations are completely bypassing the BP registration form. I’ve got a tricky Humanity plugin question on there, as well as several required fields. But when I look at the accounts the spammers are creating, they have none of those fields filled out. Is there some kind [...]