How can I monitor for bot accounts accessing drupal paths without permission?

Question

On my site, users do not have permission to create content.

However, looking through the watchdog logs, I found several accounts that were attempting to access

node/add/article
node/add/page

and so on. In this case, all the accounts were registered from @ad.drupaler.org, so it was easy to eliminate them, but in case the same thing happens from a variety of domains in the future, I'd like to set up some way to alert myself that users are attempting to access these paths.

I am thinking about using the Rules module to do this, but I was wondering if there was already a "best practice" for this kind of thing-- since there are automated bots to attack Drupal sites, there might be an automated way to fight back.

Answer 1

You could try adding bot protection to your registration form,

e.g with reCaptcha

Other worthwhile things are blocking the bots in your webserver,

e.g nginx

• https://github.com/mariusv/nginx-badbot-blocker or
• https://github.com/oohnoitz/nginx-blacklist/blob/master/blacklist.conf

Custom options include using the Flood control API,

e.g flood_is_allowed and flood_register_event with ip blocking (e.g system_ip_blocking_form_submit) or user_block_user_action on the node/add or 403 page.