BuddyPress.org

ALso: you may want to install WP-Ban and watch for the IP address of those who are driving you crazy. I suspect we are getting troubled by same punks. If so, feel free to take the list of my banned IP addresses and drop them in the wp-ban section after u install it. I managed to get about 500 attempts blocked in 3 days. Her’s my list so far. http://northafricaadvisors.com/banned-ips/

Well, I don’t know — I seem to have lucked out, or it’s just that my site is too new and so-far untrafficked, but the few very simple, small changes I made last week seem to have stopped the firstnamelastname19xx signups.

1) I changed the some of the text on the /register page.

2) I removed the “powered by” text in footer.php of my child theme (someone mentioned that it was being searched for)

3) I changed the register slug in wp-config.php

4) Added a functions.php file in my custom childtheme with the following code to redirect signups for all blogs to the Buddypress register page

function rk_signup_redirect() {

if (strpos($_SERVER['REQUEST_URI'], 'wp-signup.php') !== false ) {

$url = 'http://mydomain.com/customregisterslug';

wp_redirect($url);

exit;

}

}

add_action('init', 'rk_signup_redirect');

where mydomain.com is, you know, my domain, and customregisterslug is the slug I changed in step 3.

I don’t think I changed anything else — no captchas or anything — and I’ve received zero splog signups in the 5 days since, after getting a few a day before that. Fingers crossed.

Yep, here.

define ( 'BP_REGISTER_SLUG', 'signup' );

except rather than ‘signup’ I used ‘jointhecommunity’ as I recall.

Don’t forget to put the define statements BEFORE the STOP EDITING HERE LINE in the config.php. That had me scratching my head for a while.

Yep, one of the tricks on even a plain mu install is to rename signup. Stops ’em dead.

There’s a few automated programs out there that scammy people are selling to other scammy people to send out these automated signups. So, the things you can change from the defaults usually stop them.

stwc wrote a very good guest post for BP-Tricks where he explains the tips he gave here in a very clear and understandable way. Check out the post here:

http://www.bp-tricks.com/tips_and_tricks/stopping-the-sploggers/

@bcbccouk

That’s the exact approach I took (although I removed the admin screen because I don’t really care for it). It works wonders.

+1 for randomising the names and values. I’m going to take that bit of code!

Thanks bcbccouk I’ve updated the post and added your information and plugin link!

Signup questions and codes are a good supplement to the other methods but are also ultimately fallible. In the same way that Captcha is rendered ineffective by human relay attack, so to are questions; it will just take time for spammers to catch on.

It seems to me that the way forward is to incrementally roll out new defences, only presenting new defences when the old ones have been broken. As soon as lots of sites use a defence, that defence will probably soon be doomed to failure: spammers will only take the time to develop new exploits when a particular method of defence becomes popular. I believe this is the only reason why the hidden fields method currently works: its not sufficiently popular to bother coding an exploit for it (even though such a task would take about five minutes).

I might be missing the point completely here, but I changed my theme’s sidebar.php code to call up the root sign-up using this;

<?php printf( __( ' You can also create an account.’, ‘buddypress’ ), site_url( ‘/wp-signup.php’ ) ) ?>

Mind you, it shows the sign-up form complete with the extra fields I added via Buddypress. Does this mean it’s still being hooked into by BP and is actually bypassing the standard WP 3.0 sign-up code? I noticed that even pulling out the php and replacing it with a normal href link, it still does the same thing.