14

I have activated CAPTCHA but bots still register on the site. If someone can advise how this can be prevented.

enter image description here

enter image description here

Improve this question
1

7 Answers 7

Reset to default
6

This kind of captcha is easily recognised by OCR software within bots. You can use:

  • reCAPTCHA - it was good not so long ago and it still stops significant part of bots that would solve regular CAPTCHAs

  • Are You A Human PlayThru - a bit more time consuming for users, at least if normal CAPTCHA was readable, but at the moment most solid way I know, as it can't be replaced by software very well.

  • Confident CAPTCHA - bases on human ability to recognize and name things we see. CPU power needed to do that is significantly higher than one needed for OCR (you can OCR on mobile phone, and Google's cat recognition was using 64'000 of CPU as far as I remember), so until computers are much more faster, and CPU power cheaper, this is a pretty good way to provide robot detection.

  • Mollom could probably be used to detect attempt to post spam content, and then auto-delete users. Would require pretty complicated setup, but it would work on user's actual behaviour, so it has a potential to be a most honest way (and also auto-ban human spammers who by the very nature can solve CAPTCHAs).

Improve this answer
4
  • Will play with those in the comming days and will share the results. Cheers.
    – Ivan Ivanov
    Commented Oct 21, 2013 at 7:46
  • @IvanIvanov answer updated
    – Mołot
    Commented Oct 21, 2013 at 8:21
  • 2
    I have had great success with Are You A Human.
    – greg_1_anderson
    Commented Oct 21, 2013 at 13:39
  • I ended up using reCAPTCHA, easy to implement and have had very good success so far.
    – Ivan Ivanov
    Commented Nov 27, 2013 at 10:19
7

To specifically block bogus registrations, I've found the project MotherMayI to be a great help.

Mother May I provides a simple to use extra hurdle to reduce the bother of spamming account requests. It's primarily useful to sites with a limited target audience (at least for authenticated accounts) where valid users have some side information about the group. The site administrator can define a site-specific "secret word." Anyone requesting an account must enter the secret word before even a temporary account is created.

As the quoted text says, it is best suited for sites with a limited target audience. However, the module lets you give a "hint" that is supposed to make it simple for humans to find the secret word, and I've found that even ridiculous easy task where where the hint is "Please type in cartoon character Fred Flint's last name" (and the secret is "Flint") works great.

MotherMayI allow you to have a long "hint" text and use a RegExp for the answer, but only allow one "secret" word.

There is an alternative in the CAPTCHA family called Captcha Riddler that works similarly. It allow multiple riddles to be defined to separate humans from robots, but only allow short texts for riddles and have no RegExp function.

Since you define the "secret" word (MotherMayI), or "riddle" (Captcha Riddler), these methods are more immune to the "training" feature of Xrumer and other pests. This means the 'bot need to be trained specifically for your site. Unless your site is really huge, you'll be able to fly under the radar for a long time. And it is trivial to replace the secret word or riddle if the robot is trained to recognize your site.

Are You A Human playthru (also mentioned by Mołot) is in the same genre as the previous two, but IMHO slightly more cumbersome for humans to "solve".

Improve this answer
1
  • Thanks Gisle, MotherMayI really seems interesting but it doesn't suit my project very well. I will have a look at "Are You A Human playthru" though, seems like a really nice one and with good results. Cheers ;)
    – Ivan Ivanov
    Commented Oct 21, 2013 at 8:16
5

Another option is to use the Honeypot module.

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site (read more here). These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user [YouTube].

Improve this answer
4

If you are familiar with programming, add one hidden checkbox. Bots try to fill in everything, so they won't see its hidden. In the validation procedure->if this checkbox is filled in->filter

You will need hook_form_alter()

Improve this answer
3
  • 1
    Your answer is no longer valid. This method was so popular that bots now detects hidden fields pretty well. Smartest ones use an engine from real browser and OCR to test if checkbox with given description is seen by the real user, and omits it if it's not. More dumb ones just test for most popular dozen of ways to hide thing with CSS, and that's pretty effective, too. Forget about display:none, z-index, position, overfolw et cetera. And if you know method that works, it will cease to work weeks after you post it anyway.
    – Mołot
    Commented Oct 21, 2013 at 7:41
  • 3
    Thanks for the feedback of the answer. Still,for the sake of the argument, I implemented ONLY this method and the spam users decreased drastically (like, 99 %)
    – Oleg Videnov
    Commented Oct 21, 2013 at 8:45
  • 1
    So I was a target of next generation of bots. I feel so appreciated now :D
    – Mołot
    Commented Oct 21, 2013 at 9:35
4

I tried many configurations of captchas, with deceiving results most of the time. But I found the graal to forget definitively bots : botcha.

This module is amazing for 2 reasons :

  • I've never had any spam submission of my forms anymore.
  • It's user friendly, as it is completely transparent and non-intrusive.

As says the project : spambots learned to bypass CAPTCHA really well, and real users are frustrated with increasing complexity and burden of CAPTCHA. Instead, BOTCHA lets spambots to prove they are bots, and let real users zip by.

Improve this answer
2
  • Actually this one seems pretty interesting, I may give it a try. Thank you for sharing it with us.
    – Ivan Ivanov
    Commented Oct 22, 2013 at 22:51
  • Thanks for recommendation, installed today, will see if it helps.
    – NPC
    Commented Oct 24, 2013 at 10:43
4

Have you considered the possibility that humans (paid a miserable pittance per form) are filling in the forms and not bots? My site gets dozens of spam registrations a day and it used to be hundreds. We tried Riddler and similar techniques but they get past every CAPTCHA.

The best solution we have found is using Views Bulk Operations to monitor new registrations. During business hours we block spammers a few times a day, after hours they are blocked by default and we approve them the next day.

Improve this answer
2

I have had great success with reducing spam registration with the Spambot module. It connects to the StopForumSpam API and will prevent IPs and email addresses matching entries in their database.

In addition, the module allows you to retroactively review your userbase for bogus user accounts and will unblock / delete them as you see fit. You can also report new bogus accounts to the SFS database if you generate an API key.

Another great tool in the kit to help solve this problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.