Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

I'm currently doing recruitment system by using drupal 7.. In my system, the user (anonymous) need to register before they can log in into the system. For log in and registration, i use LoginToboggan module. i also use the captcha module to avoid from spam. However, when i look at the people..there is a lot of unknown user.. and it seems like spam. what should i do?

enter image description here

share|improve this question
    
Are you sure that you protect the registration form with CAPTCHA? –  Елин Й. Jun 17 at 9:10
    
yes i am sure..what should i check to ensure my captcha is working? –  Izzwan Jun 17 at 9:15
    
I would also recommend you to set the user registrations to be approved by administrator. You can find this setting under admin/config/people/accounts –  Елин Й. Jun 17 at 9:16
    
Did you go to the modules settings page (/admin/config/people/captcha) and enable the captcha for user registration form? –  Pontus Nilsson Jun 17 at 9:17
1  

3 Answers 3

up vote 6 down vote accepted

These are robot spam registrations. To my eye, they look like they originate from XRumer. XRumer knows how to complete the registration process of LoginToboggan and knows how to solve simple CAPTCHAs, so these measures will not stop XRumer from registering.

The modules I've found to be most effective against robot spam registrations are MotherMayI and CAPTCHA Riddler.

Both these are based upon the same idea: To register, the registrant should be able to answer a simple question where the answer is obvious to a human, but not to a robot.

If you site's language is not English, almost any question will work, since robots do not have multi-language skills.

CAPTCHA Riddler lets you set up a "pool" of questions (so a returning robot will face a different question on each visit). MotherMayI only allows one question, but let you set up an RegExp for the answer and also has allows for a longer text to "hint" to a human what is expected. I currently prefer MotherMayI, but check out both.

PS: So far, no spam robot has managed to register at any of my 20 sites (all that accepts registrations by the public are protected by MotherMayI).

share|improve this answer
    
so that's mean, the xrumer know how to complete the logintoboggan registration module even there is a CAPTCHA? –  Izzwan Jun 17 at 9:40
    
@Izzwan Captcha has been broken for ages, probably best to move on to other prevention methods these days (or at least look at adding other methods alongside) –  Clive Jun 17 at 9:51
    
@Izzwan, CAPTCHA just means "Completely Automated Public Turing Test To Tell Computers and Humans Apart". There are different types of CAPTCHA you can use. However, XRumer knows how to complete the LoginToboggan registration module when there is a simple CAPTCHA of the type that distorts characters or poses math questions. Other types of CAPTCHA (like those riddle based CAPTCHAs I suggest) still works on my sites. –  Free Radical Jun 17 at 10:14

If Captcha isn't working (and you definitely have it turned on, obviously), I'd recommend using something like Botcha instead:

BOTCHA is a highly configurable non-CAPTCHA spam protection framework.

In CAPTCHA, user has to prove he/she is human. Unfortunately, spambots learned to bypass CAPTCHA really well, and real users are frustrated with increasing complexity and burden of CAPTCHA.

In BOTCHA, we don't abuse our human users - BOTCHA protection is completely transparent to them and non-intrusive.

BOTCHA lets spambots to prove they are bots, and let real users zip by.

Works a lot better than Captcha in my experience, and less intrusive to the user. Bear in mind this is just one spam-prevention tool, depending on how hard your site gets hit you might have to take more drastic measures.

share|improve this answer

You can also consider using Honeypot or Mollom.

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site. These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user.

So, Honeypot has the same philosophy as Botcha (spam bot centered).

Mollom has Acquia / Dries Buytaert experience of Drupal behind and provides combined features: text analysis, spam database, then CAPTCHA if there is a doubt about the content + hidden honeypot feature. Several plans are proposed (free / paying), depending on the amount of spams and service wished.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.