7

I have a new Drupal 7 site at mysite.com (address changed) - a CentOS 5.5 Linux machine in my full control.

By reading registration mails (they run through my Gmail account) I've noticed, that Drupal spammers seem to refer to my site via the address forum.mysite.com. Since any requests to a subdomain.mysite.com are redirected by my hoster to mysite.com, this works for them.

I wonder, if anyone has noticed same pattern (seems to be some common spammer tool behaviour) and what have you done? I'm thinking of using mod_rewrite to block access to forum.mysite.com, but maybe there is a better way? (Because I'm not sure if that spammer tool will go away if I close access to forum.mysite.com).

I've also thought of maybe changing my httpd.conf somehow:

NameVirtualHost 11.22.33.44:80

<VirtualHost 11.22.33.44:80>
    DocumentRoot /var/www/html/mysite.com

    ServerName mysite.com
    ServerAlias mysite.com *.mysite.com

I'm not asking about Mollom or Captcha modules, because they seem to be not-up-to-date for Drupal 7 yet. And the spam users aren't a too big problem for my site anyway, because it has a card game embedded at the front page and I have a cron job deleting users not playing that game.

Improve this question

10 Answers 10

Reset to default
9

There is Honeypot as well

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site

Usually, forms take at least a few seconds to fill out when a human is entering data into them—especially surveys, user registration forms, etc. Spam bots try to fill out as many forms as they can in as little time as possible, so they will often fill out a form within a couple seconds at most. The Honeypot module requires at least 5 seconds to pass (by default - you can adjust this too!) before a form can be submitted.

Alternative modules

There are many spam-protection modules on drupal.org, some of which have more or less robust methods of dealing with form spam. Some of the most used and recommended include:

  • Mollom - Offers spam protection through their premium service.
  • CAPTCHA - A simple image-based CAPTCHA builder.
  • reCAPTCHA - Implements reCAPTCHA for image-based CAPTCHAs.
  • Hidden CAPTCHA - Similar to this module in it's effectiveness.
Improve this answer
1
  • 1
    Honeypot maintainer here; you can also do some more advanced things with Honeypot like Drupal.org does to make it even harder for spammers to do their work. Check out the hooks in honeypot.api.php.
    – geerlingguy
    Mar 26, 2013 at 0:26
3

If there is any kind of form involved, try this:

I have had great success by using a fake e-mail field. The field named 'e-mail' was invisible and would never be filled out by users.

The e-mail field that I actually used was named something different, e.g. e-mail2.

Spammers would fill out the field named 'e-mail', which instantly marked them as spammers. Users would never even see that field.

If there are no forms involved or you cannot do this in Drupal, you can ignore this answer. ;)

Good luck!

Improve this answer
5
  • 1
    Thanks for your reply! I welcome any creative answer and this is one of them :-) Currently I actually have a Gender field (because I need to know user Gender for my card game anyway) and set it to Robot/Male/Female - it works similar to your suggestion - if someone enters Robot there, I delete that account after 2 days by a cron job.
    – Alexander Farber
    Mar 14, 2011 at 14:59
  • I expect Timo's solution to work better than the Robot/Male/Female solution. If you offer three options, robots can randomly choose one, which would mean that -in theory- only one out of three bots will register as 'robot'.
    – marcvangend
    Mar 14, 2011 at 15:22
  • 1
    Thanks for your reply, Alex! Keep in mind that people may choose robot for fun, or because they are a little strange. :) I would feel sour to be deleted for such a prank! ;)
    – Timo
    Mar 14, 2011 at 15:55
  • This technique is called the 'honeypot' technique, and the Mollom modules utilises this as well to help determine HAM from SPAM out of the box
    – wiifm
    Mar 27, 2011 at 10:32
  • And the Honeypot module (drupal.org/project/honeypot) does this without requiring any third party interaction :)
    – geerlingguy
    Jan 21, 2013 at 22:39
3

As far as I can see, the Mollom module is ready for Drupal 7. Based on my Drupal 6 experience with Mollom, I would recommend it.

Improve this answer
1
  • 2
    Mollom is definitely ready for D7. I would recommend this solution too.
    – Haza
    Mar 14, 2011 at 17:53
2

For the registration process, I would suggest the Spambot module. It will stop bots trying to register by verifying their IP address, email address and username on Stop Forum Spam website.

You can optionally contribute to that service by automatically submitting your website's registration attempts.

No hassle for human users like captchas!

Improve this answer
1

You can also use a Captcha module to stop bot spammers. drupal 7 version is in beta, but does work.

A CAPTCHA is a challenge-response test most often placed within web forms to determine whether the user is human. The purpose of CAPTCHA is to block form submissions by spambots, which are automated scripts that post spam content everywhere they can. The CAPTCHA module provides this feature to virtually any user facing web form on a Drupal site.

Improve this answer
0

My solution for now is to block access to forum.mysite.com/user/reset/.... by using mod_rewrite:

    RewriteEngine on
    RewriteCond %{HTTP_HOST} ^forum.mysite.com$
    RewriteCond %{REQUEST_URI} ^/user
    RewriteRule .* - [L,F]

I will see if it gets better with SPAM-robots in few days...

Improve this answer
0

Coming to the party a bit late on this question, but here is a solution that has worked for me.

I have a local community based site. There is no reason for someone in Russia, for example, to ever access my site. Many of my spam posts originate from some other country. Analyzing my google site analytics I can see where those are, and, with geo ip location being solid enough to at least determine to overall country origin of, I can block them having access to any of the site. So far, I have never had anyone in my community tell me they were blocked or had problems with this, and the logs tell the same story.

Improve this answer
0

So far my best experience has been adding a few fields to the registration form in combination with rules. I do like the geo IP approach even though we don't have a strictly locally based user base; past logs from a Wordpress hosted site shows that we don't have users from countries that a majority of SPAMMERS come from.

Improve this answer
0

I would also reccommend the Mollom module; it has helped reduce so much spam on my site, even though it still gets a little bit. Install Mollom Module for Drupal has a easy guide to installing Mollom.

Improve this answer
0

As a default, I include the following modules on Drupal 7 sites to prevent or drastically cut down on bogus accounts from being created, especially in cases where the client has requested new users only require a self-verification of their email (which spambots can sometimes get around):

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.