newbie question...


Before "exploding" my site, I would like to know if I can mix :
- https://drupal.org/project/honeypot
- https://drupal.org/project/regcheck

I'm trying to stop the registration process before sending a request to the server (regcheck) and still have an efficient protection from spam (honeypot).

More generally, is mixing antibot modules a good idea?



While it probably will do no harm, there is not much point in using both.

Regcheck is a small and super simple module that will add an invible (to humans) checkbox on your registration form. Bots will check this, and when the bot submits the form, it can be rejected.

Honeypot is a larger and more complex beast that do several thing to block 'bots. One of these thing is to let you add an invisible (honeypot) field to any form - including the registration form. From the Honeypot docs:

Honeypot form protection means that an invisible field is added to a form. If this invisible field is filled out (bots will usually put in a value), then the form will return an error. Normal users (read: human beings) won't ever see the field, so they won't fill it out.

If you install both, your registration form will have two invisble (to humans) fields. There is little harm in that (having both installed will consume slightly more resources), but not much benefit either .

So I suggest you install Regcheck if you want a simple solution with minimal configuration just to stop 'bots from registering, and Honeypot if you want a more comprehensive anti-spam solution.

However, if you're looking for a solution that stops bots before they hit the registration form submit button, neither Regcheck nor Honeypot will help. Both work by automatically dismissing registrations after they've been submitted.

If you want to block bots from trying to register, you can't do this by Drupal alone, but need to use webserver access rules.

There are projects, such as Project Honeypot (no relation to the Honeypot module) and Fail2ban that will do this for you.

To set up a Drupal site to use the Project Honeypot blacklist of IP-addresses, there is also a Drupal module, http:BL. AFAIK, there is no Drupal module for Fail2ban, but since it work directly with the the server, you don't need one.

  • The thing is, to work, honeypot needs the "create account button" to be hit, sending a query to the server (and so consuming server resources; I have an endless list of login attempts). I'm trying to figure out a way to prevent that query to the server (to "kill" registration process), while protecting the site from bots if the first module fails to stop the bots. That was the idea behind the use of those 2 modules. But maybe there is a better "mix" of modules that could be used? Thanks – Blonde_Girl_of_the_Web Feb 6 '14 at 17:30

You should be able to use both modules together though I think they overlap in their abilities. regcheck focuses only on the registration form and honeypot should be able to work on any form. So you should be able to get by without regcheck.

Not the answer you're looking for? Browse other questions tagged or ask your own question.