BuddyPress.org

My BP site is fairly new. I had one PM spammer and I changed my register slug and added birth day to the required fields and so far no return spammers (about 1000 new members per month, 4,000 current). I’m sure this won’t end attacks, but hopefully it with stave off many of the BOTS.

Maybe BP should require that you choose your own register slug after activating the plugin. Perhaps also require you name your required fields fields, instead of the default “name” or “base.” The less default settings BP has the harder it is for BOTS.

I’m getting these on my own site. These are spam bots and they found a way into BP. This should be a number one priority for BP. I’ve seen this stuff with phpbb and other CMS. It very easy for these people to bring down your site.

are you hosted at godaddy? my programmer thought it had to do with the following:

• can you check the hosting company if they have GD library correctly installed- go daddy said everything was fine, but their email customer service seems to be done by robots as they never answer correctly, they said it had to do with folder permissions which was not the case.

WP does generate a virtual robots.txt file, but I’m not sure if you can count BP in the mix as I’m not quite sure if BP does anything to it.

Try using this plugin to manage WP’s virtual robots.txt:
https://wordpress.org/extend/plugins/pc-robotstxt/

FYI, Today I updated SI CAPTCHA Anti-Spam for latest version of buddypress 1.2.3 compatibility

SI CAPTCHA Anti-Spam

https://wordpress.org/extend/plugins/si-captcha-for-wordpress/

This plugin adds CAPTCHA anti-spam methods to WordPress on the comment form, registration form, login, or all. In order to post comments or register, users will have to type in the code shown on the image. This prevents spam from automated bots. Adds security. Works great with Akismet. Also is fully WP, WPMU, and BuddyPress compatible.

The best trick I learned for fighting spam bots is to ask a question that only a human can answer and making them type it into a text box. If you change the question daily or randomize it, it makes it even tougher. Don’t do anything like math or captcha or something that a bot can calculate or decipher. Ask a question like “What color is snow?” or “How many sides does a triangle have?”

+1 for that idea, I had this on 2 SMF forums and it does work. While it doesn’t stop the odd human Spammer from registering, it stops bots dead in their tracks.

Maybe a coder would consider making such a BP plugin.

There are multiple entry points for SPAM bots… so any one measure probably won’t accomplish much. I posted a list of everything I did in the “Spam, Spam and more Spam” thread. Worse case… you could try captcha.

I just clued in that these bots are probably all using proxy servers… and compiling a big list of them all would be futile. So I found this htaccess code that blocks servers based on their methods. I know this topic has gone beyond specific BuddyPress fixes… but I’ve done all of the BuddyPress fixed (and more) and I’m STILL getting SPAM signups. So perhaps this will help someone else.

RewriteEngine On

# block proxy servers from site access

RewriteCond %{HTTP:VIA}                 !^$ [OR]

RewriteCond %{HTTP:USERAGENT_VIA}       !^$ [OR]

RewriteCond %{HTTP:FORWARDED-FOR}	!^$ [OR]

RewriteCond %{HTTP:FORWARDED}           !^$ [OR]

RewriteCond %{HTTP:X-FORWARDED-FOR}	!^$ [OR]

RewriteCond %{HTTP:X-FORWARDED}		!^$ [OR]

RewriteCond %{HTTP:PROXY_CONNECTION}    !^$ [OR]

RewriteCond %{HTTP:XPROXY_CONNECTION}   !^$ [OR]

RewriteCond %{HTTP:XROXY_CONNECTION}	!^$ [OR]

RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]

RewriteCond %{HTTP:HTTP_CLIENT_IP}      !^$

RewriteRule ^(.*)$ - [F]

Credit goes to: http://perishablepress.com/press/2008/04/20/how-to-block-proxy-servers-via-htaccess/

I’ll try. I just got a new registration from ANOTHER .info email address. Minutes ago. Ugh Unreal.

I’ve done everything mentioned in this thread and MORE. And no dice. Kind of at my wits end. How the heck are they signing up?! Unless it’s humans signing up. But I assume all SPAMers use bots. Even if it’s not a bot… I don’t know how you’d ever find the signup page with Google. It has a custom slug and I’ve gotten rid of the default BuddyPress text.

Anyway. Thanks Andrea.

I wonder if this would work in .htaccess

deny from .*\\.info.*

@Andrea_r How do your say “SPAMbots please screw off” in Latin? LOL. Maybe Google can translate for me.

No more SPAM registrations since my last post. Fingers crossed.

Did you find out how to use regex in the WPMU “banned domains” setting?

Okay… I am STILL getting SPAM registrations. I’ve done the following:

• Changed signup slug
• Installed hashcash (works with BP now)
• Disabled “Allow blog administrators to add new users…”
• Deleted BuddyPress credit in footer.php
• Deleted wp-signup.php
• Created a robots.txt file to disallow robots from my signup slug

Any more ideas? Short of Catcha? Altho’ I’m thinking even that won’t work.

You might like to get some anti bot plugins from wordpress. I have WordPress MU and Buddypress and use the following plugins to prevent bots from joining my site.

WP-SpamFree – An extremely powerful anti-spam plugin that virtually eliminates comment spam. Finally, you can enjoy a spam-free WordPress blog! Includes spam-free contact form feature as well. http://www.polepositionmarketing.com/library/wp-spamfree/

WPMU Super Captcha – Custom captcha program made to stop spam bots cold in their tracks. Features audio, word files, or random text. You configure it! https://wordpress.org/extend/plugins/super-capcha/

Or go to http://www.wordpress.org, click on extend and find them there.

So to sum up:

• Change your signup slug
• Add some required custom profile fields (or use the hashcash trick posted at the start of this thread)
• Disable “Allow blog administrators to add new users to their blog via the Users->Add New page”
• Delete BuddyPress credit in footer.php
• Delete wp-signup.php
• Create a robots.txt file with User-agent: * Disallow: /register/ (or whatever your slug is)
• If all else fails, use CAPTHCA or preferably a simple random question (what colour is snow)

Am I wrong or missing anything?

Also… all of my SPAM registrations were coming from .info domains. I added this to my .htaccess file but I’m not sure it’s correct. I found a million examples via Google search for how to ban full domains or subdomains… but nothing about blocking an entire extension (i.e… whatever.info). Anyway, this is what I wrote:

RewriteCond %{REMOTE_HOST} \\.info$

RewriteRule .* - [F]

I am seriously considering using a robots.txt file to noindex nofollow my sitewide activity page and members page.

Just to see what happens.. I have lost position for some keywords with the newer theme and setup now.. I also want to find where the alt-tage for my stie title is showing in the code so it is not alt-taged “home” – I think those things will help it get to where it was.

I’m starting to get hit now :o( I have had a custom slug for weeks. I added a robots file today disallowing bot access from /my-signup-slug/ and also installed invisible defender but I’m still getting spam registrations. I also just deleted my wp-signup.php file. I’m going to try hashcash. I’m also considering a htaccess file that simply bans ALL traffic to the entire website from Russia, China and any .info domains.

Google ‘robots.txt file’ for starters

the activity means someone who is active on the site… registrations have to be complete before being considered active… this is to avoid spam bots to be considered active on the site… so when the new members visit the site back and “do” something, they are tracked by the actvity stream.

All in all, here’s my approach that I use on MU/BP sites ~

1) modify the register/register.php wp-signup.php hardcoded default text and url slugs.

2) enable xprofile and require additional fields upon registration.

2) use a captcha ~ i’m fond of ReCatcha

3) make sure you and check the NO setting under “Allow blog administrators to add new users to their blog via the Users->Add New page. ” in wp-admin/wpmu-options.php “Admin > Site Options”

4) I ban or limit the registration domains (also in Admin > Site Options) so that the commonly used spammer domains are blocked from registration and then I add an email contact for owners of these addresses to manually request registration. I hide the email address from bots with HiveLogic EnKoder

5) I then firewall off entire blocks of IP’s from my servers from commonly used spammer IP ranges you can find at sources like spamhaus.org .. and considering that these are one language sites, the need for access for the IP blocks on the pan asia network or eastern europe are unlikely. If you have a multilingual site, this might cause issues to very few users. Cpanel, Plesk, BSD, etc have tools to do this.. if you’re on a shared server, ask your hosting provider if they can do it for you, and they may be likely doing it already.

6) I also recommend using Askimet.

Definitely remove the footer link if you haven’t already.

I noticed a issue with spammers using CURL to download /registration so blocked that in .htaccess (It’s been mentioned on a thread somewhere how to)

renaming the slug ‘registration’ is supposed to help.

For me deactivating blog signup improved things significantly. Didn’t need users to be able to register for a blog at initial sign up they can take a blog once they are members.

Despite all efforts and much study and approaches instigated one after the other to gauge effectiveness before adding next one I still am not sure how a few of the automated bots get through, human signups there isn’t much you can do about them apart from delete manually.

All my efforts still result in around 10 signups daily that require dealing with manually.