BuddyPress.org

I am having major problems with spam as well. Ironically it started as soon as I put my link in the showcase thread on this forum. I think the spam bots are looking there for easy targets as well.

Why do people make spambots that don’t even advertise stuff and just waste everyone’s time filling sites with meaningless crap. Is it like they are trying to sabotage Buddypress?

How does one submit domains and sites and IP addresses to spam traps.

I have adjusted the wp-hashcash plugin to work with buddypress signup. Here is what I did: I got the wp-hashcash plugin and I added the following code to the file:

global $bp;

// get our options
$options = wphc_option();
$spam = false;
//if( !strpos( $_SERVER[ ‘PHP_SELF’ ], ‘wp-signup.php’ ) )
//return $result;

// Check the wphc values against the last five keys
$spam = !in_array($_POST[“wphc_value”], $options[‘key’]);

if($spam){
$options[‘signups-spam’] = ((int) $options[‘signups-spam’]) + 1;
wphc_option($options);
$bp->signup->errors[‘spam’] = __(‘You did not pass a spam check. Please enable JavaScript in your browser.’);
} else {
$options[‘signups-ham’] = ((int) $options[‘signups-ham’]) + 1;
wphc_option($options);
}

}
add_action( ‘bp_signup_validate’, ‘wphc_check_signup_for_bp’);

function wphc_error_hook_register_page(){

do_action(‘bp_spam_errors’);

}
add_action(‘bp_before_register_page’, ‘wphc_error_hook_register_page’);

Then, under the line (line number about 507)

I put this line:

Then I activate the plugin. It should keep spam bots from being able to create accounts, but humans spammers can still do it. Anyway, if you can’t get it to work, let me know via PM and I will try to send you the file.

Later

I will but I would like to take a little more time to see if it works. So far it looks like it does. However I have not tried on bp 1.2. Gotta install that first and see how it goes there.

I wholeheartedly agre with @andy. It’s an age old debate between making it as simple as possible to register and become a member and requiring some unique information that not only serves your purpose well but adds an extra layer to the process that fights spam.

We have been running our prod site since BP was in alpha (Nov ’08 – crazy, I know) but have had only 2 spam registrations. Both were from Russia and both seemed pointless. But we banned the domain in the WP backend and have had none since. We have not even changed our signup slug.

That said, we require 5 fields on registration, 3 are drop downs and we don’t allow blog registration (we’re building a community not a blog network)

On a side note: We ran reCaptcha flawlessly for 6 months. We disabled it as an experiment to see if we could avoid that extra step (plus reCaptcha words are damn hard to read) and have not had spam since. fingers crossed.

Changed the signup slug to something unusual last night. Had a new splogger 11 minutes ago. They’re not actually making blogs, just accounts.

You can change your registration slug by adding this to your wp-config.php file (above the stop editing line):

define( "BP_REGISTER_SLUG", "create-an-account" );

You can then happily upgrade without worrying if it will break.

Reference:

https://codex.buddypress.org/how-to-guides/changing-internal-configuration-settings/

@andy I have been meaning to ask you: how do I get a BP module to register as a site wide plugin so that it shows up in the site wide plugins list? BuddyPress and the example module register as site wide plugins but my own module doesn’t — it activates as a regular plugin that has to be activated for each blog within wpmu. I have followed the example model step by step. Is there some magic line of code that I’m missing?

Thanks.

After changing the register slug, what can you use to get the right redirect?

Tried this:

bp_core_redirect( bp_signup_page() );

But it just prints the URL on a blank page.

This works of course:

bp_core_redirect( $bp->root_domain.'/mycustomslug' );

But I shouldn’t hardcode. Already got email complaints caused by links I’d missed…

@guristu Right… but can bots submit drop down values? For instance, I have a drop down for “Training Level” which is a required field. If it’s left at “please select”… the form will return a required field error.

Just to add something to this (upcoming)paranoïa tread

Since i use the signup trick, i have no more spam registering but receive personnal mails who ask for help for some minor wp troubles…

These mails are send from another part of my site where I have a contact form.

Pleasant for me is to see that this form is on a different CMS (absolutely not wp) but with a look alike BP template.

Difficult for me is to NOT answer these mails…

It seems that some spammers are desperatly searching for IP’s…

I started the group for splogging and spam a while ago, but to be honest I haven’t experienced any for quite a while now.

@andy’s right about changing the signup slug, that made a big difference for me. I also renamed (removed) the wp-signup.php file as that’s not in use, and again that made a difference – though watch for that on a wpmu / wp upgrade as it’ll replace the file.

I removed the WordPress references in my theme footer too, just to make it a little less obvious that I’m running WP.

Also running SI-Captcha antispam and NoSpamNX, but that’s about it nowadays.

You lucky, the spambots that are after me figure out the new slugs after a few days.

I am actually considering setting up a botnet to jam up their IP’s and domains as payback lol

Yes, just add that to the config file. Don’t move any files or folders around.