I'm currently doing recruitment system by using drupal 7.. In my system, the user (anonymous) need to register before they can log in into the system. For log in and registration, i use LoginToboggan module. i also use the captcha module to avoid from spam. However, when i look at the people..there is a lot of unknown user.. and it seems like spam. what should i do?

enter image description here

  • Are you sure that you protect the registration form with CAPTCHA? Jun 17, 2014 at 9:10
  • yes i am sure..what should i check to ensure my captcha is working?
    – Izzwan
    Jun 17, 2014 at 9:15
  • I would also recommend you to set the user registrations to be approved by administrator. You can find this setting under admin/config/people/accounts Jun 17, 2014 at 9:16
  • Did you go to the modules settings page (/admin/config/people/captcha) and enable the captcha for user registration form? Jun 17, 2014 at 9:17
  • 1
    Related: drupal.stackexchange.com/questions/68630/…
    – user11153
    Jun 17, 2014 at 10:29

3 Answers 3


These are robot spam registrations. To my eye, they look like they originate from XRumer. XRumer knows how to complete the registration process of LoginToboggan and knows how to solve simple CAPTCHAs, so these measures will not stop XRumer from registering.

The modules I've found to be most effective against robot spam registrations are MotherMayI and CAPTCHA Riddler.

Both these are based upon the same idea: To register, the registrant should be able to answer a simple question where the answer is obvious to a human, but not to a robot.

If you site's language is not English, almost any question will work, since robots do not have multi-language skills.

CAPTCHA Riddler lets you set up a "pool" of questions (so a returning robot will face a different question on each visit). MotherMayI only allows one question, but let you set up an RegExp for the answer and also has allows for a longer text to "hint" to a human what is expected. I currently prefer MotherMayI, but check out both.

PS: So far, no spam robot has managed to register at any of my 20 sites (all that accepts registrations by the public are protected by MotherMayI).

  • so that's mean, the xrumer know how to complete the logintoboggan registration module even there is a CAPTCHA?
    – Izzwan
    Jun 17, 2014 at 9:40
  • @Izzwan Captcha has been broken for ages, probably best to move on to other prevention methods these days (or at least look at adding other methods alongside)
    – Clive
    Jun 17, 2014 at 9:51
  • @Izzwan, CAPTCHA just means "Completely Automated Public Turing Test To Tell Computers and Humans Apart". There are different types of CAPTCHA you can use. However, XRumer knows how to complete the LoginToboggan registration module when there is a simple CAPTCHA of the type that distorts characters or poses math questions. Other types of CAPTCHA (like those riddle based CAPTCHAs I suggest) still works on my sites. Jun 17, 2014 at 10:14

If Captcha isn't working (and you definitely have it turned on, obviously), I'd recommend using something like Botcha instead:

BOTCHA is a highly configurable non-CAPTCHA spam protection framework.

In CAPTCHA, user has to prove he/she is human. Unfortunately, spambots learned to bypass CAPTCHA really well, and real users are frustrated with increasing complexity and burden of CAPTCHA.

In BOTCHA, we don't abuse our human users - BOTCHA protection is completely transparent to them and non-intrusive.

BOTCHA lets spambots to prove they are bots, and let real users zip by.

Works a lot better than Captcha in my experience, and less intrusive to the user. Bear in mind this is just one spam-prevention tool, depending on how hard your site gets hit you might have to take more drastic measures.


You can also consider using Honeypot or Mollom.

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site. These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user.

So, Honeypot has the same philosophy as Botcha (spam bot centered).

Mollom has Acquia / Dries Buytaert experience of Drupal behind and provides combined features: text analysis, spam database, then CAPTCHA if there is a doubt about the content + hidden honeypot feature. Several plans are proposed (free / paying), depending on the amount of spams and service wished.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.