Over 50% of the traffic to my BP sites are from bots accessing /register when I’ve changed the slug to create-account. This is causing over charges on my hosting. What’s the best way to set up a system where anyone who visits that URL is automatically block by ip?
I frequent the BuddyPress site often: to learn, to help, to discover something new being developed, and to see how others are using BP. I enjoy using BP. Unfortunately, there seems to be a slowdown again. This happened in the spring and it’s happening again.
Now, this is minor challenge to the success of BP but was never fully addressed the last time it happened. There was a flurry of activity and eventually important people disappeared again. We really need to show active development of the product. Here are three examples that come to mind.
Example 1: Product Announcements
BP 1.2.7 is in a holding pattern for packaging and distribution. There should be an announcement group, and those announcement posts should be stuck to the top of the support topic thread page. After all, I believe an important portion of this website is the support forums but also giving out important information about BP development.
Example 2: New Features
I also believe development of some cool features are being held up. For example, real time activity stream should be a high priority. This would set the product apart from the competition. Two plugins exist as half-solutions. However, there seems to be a lack of will to move forward. Maybe that is me projecting something onto other people’s lack of action. Maybe that is cruel and I’m just pissed that someone on bbpress.org marked me as a spammer. But I truly mean my statements in a way to prompt action in developing code and not anger. Sorry if this post offends but I’ve watched BP languish in minor details rather than reaching out toward improved features. BBPress as a plugin will be a great compliment to BuddyPress and hopefully allow this site to have improved forums.
Example 3: Forum replies
In terms of the support forums, some people are answering questions as best they can but I’m noticing time lags are getting longer and that might turn people away from using the product. I don’t have an immediate solution – except to suggest that discussions begin (or re-addressed) about how to make the forums more efficient and get more people involved.
Well, thank you for letting me vent my concerns. I can’t get to the developer chat sessions due to the times (I work during those hours). I look forward to BP 1.2.7, newer features, and better support and announcement forums.
Deactivating plugins didn’t help. I have added the following items to .htaccess. The first rule is the problem but cookies for comments plugin says to add it to stop spam blogs.
#Cookies for comments
RewriteCond %{HTTP_COOKIE} !^.*XXXXXXXXXXXXX.*$
RewriteRule ^wp-signup.php – [F,L]
AND
# BEGIN ANTISPAMBLOG REGISTRATION
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-signup.php*
RewriteCond %{HTTP_REFERER} !.mysite.com. [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) http://die-spammers.com/ [R=301,L]
# END ANTISPAMBLOG REGISTRATION
Jenny remove the blog signup section from the BP register page.
also adjust the WP footer links to something non standard as that is also a keyword search.
Other than that there have been some very long threads on this subject of spam signups and all possible tactics have been covered in those so do do a search for that info.
You should robots.txt exclude these files
nevermind, I found it, they are in the register.php file.
I fixed most of mine by adding a few fields in the Profile Field Setup. I added City, State ( as a dropdown menu and a zipcode. I got rid of 70% just from this. also, I have seen in my log files they are searching for
“yes i d like to create a new blog”
“registering for this site is easy just fill in the fields below and we ll get a new account set up for you in no time yes i d like to create a new blog”
“intext yes i d like to create a new blog blog with wordpress inurl register”
“i d like to create a new blog”
maybe someone can tell us where this text lives so we can remove these tags from the search engines. just by this they are able to see all wordpress sites. I tried it with google and it does work.
I am using WP3.0.1 , BP1.2.6 , with Asismet and Badbehavior installed.
yesterday, I got 20 spammers registered on my blog, and each of them created a blog. I deleted them, and put their IP in host’s “Banned IP”;
Today when I wake up, I got another 20 spammers and their blogs again.
So, I have to change WP option to be “logged in user may register blog”, this makes visitors can’t signup.
I want my blog can be freely signup and can create blog after they logged in as a member.
What can I do to enable visitor registering and block spammers?
I was just curious, wondering if spammers could use these extra signup files.
7329803Inactive
Spam post removed – hnla
@boonebgorges @DJPaul can we ban this member
Try the BuddyPress Moderation plugin. I think you’ll like it.
[edited by r-a-y to add link]
https://wordpress.org/extend/plugins/bp-moderation/
Or even just “report user” – because there could be all kinds of community violations besides spam.
Thanks!
I don’t know if anyone is still following this thread but I discovered the users with this problem had not activated the account. So I installed this plugin so I didn’t have to keep deleting and recreating these accounts. https://wordpress.org/extend/plugins/wp-activate-users/installation/
FYI the users either were not receiving the email, or so they say, or the message went to spam or didn’t activate when they clicked the link.
hope this helps.
chow
I am using Buddypress 1.2.6 on WordPress 3.0.1 and I am experiencing a weird error.
When I mark a user as a spammer I get two or three of my own legitimate blogs marked as spam blogs. Does anyone have any idea how this could be happening? Could it be a plugin conflict?
Thanks,
John
Humans always fill out required profile fields. 
Thanks. How do you know if there human or bots?
The code from this post is the correct one:
https://buddypress.org/community/groups/how-to-and-troubleshooting/forum/topic/buddypress-spam/?topic_page=3&num=15#post-69499
Replace example.com with your sitename.
And yes, it works just fine on my site; no bots are getting through
But lately I’ve been getting slammed by human sploggers. That’s a tougher nut to crack.
That was the original post I seen, but then I seen
https://buddypress.org/community/groups/how-to-and-troubleshooting/forum/topic/buddypress-spam/?topic_page=5&num=15#post-74351
and there was another version floating around some where that was slightly different. As you can see this version just has .register* and then domainName.*
I wasn’t sure which was correct or how to check if its working. Have you ever successfully tested yours?
Anyone know how to check the above to confirm its doing what its supposed to?
Also, is the 3 supposed to be myslug, or register.php?
Is line 4, just domainName, or domainName.Com?
Hi, I’m still seeing this issue. Not so much on the spam side, but I’ve got a field that is set to be required that isn’t actually required in order to sign up.
It’s in a 2nd group of profile fields, if that matters. Here’s the relevant code, which should be working … but isn’t.
http://pastebin.com/Gq5Ay5fH
Well things were all good for a month, now I am getting slammed every night from 2-6am.
Can someone confirm this is correct (if my site were ebay.com and my registration page was myslug)…
‘
# BEGIN ANTISPAMBLOG REGISTRATION
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .myslug*
RewriteCond %{HTTP_REFERER} !.*ebay.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) http://die-spammers.com/ [R=301,L]
# END ANTISPAMBLOG REGISTRATION
‘
Reading back a page or two this is supposed to redirect attackers, I tried entering myURL?something=something but it doesn’t do anything. How can I test this to make sure it working?
Thansk.
When I click on the admin bar’s sign up link from any sub blog it gives me a 403 error.
“Forbidden,
You don’t have permission to access /wp-signup.php on this server.”
I installed Cookies for Comments and added…
RewriteCond %{HTTP_COOKIE} !^.*XXXXXXXXXXXXXXX.*$
RewriteRule ^wp-signup.php – [F,L]
This is what is causing the 403 on my sub blogs, but I’m not sure what to do to fix it. This has stopped spam on my blog so I don’t want to ditch it.
Any help would be awesome! Thanks in advance!