I am getting lots of spam in my website. Here are some modules I tried as a remedy:

  1. Honeypot
  2. Http BL

No luck yet however.

Now I decided to make the site available only for web services only, whereas the web services are done with Services module.

So how can I allow access to my website via services only? Is there something I can achieve this from .htaccess ?

  • 1
    for spam control I think you can also try changing the admin url and user login url using this module
    – shrish
    Mar 20, 2015 at 6:02
  • @shrish, good point. I'll try that too....
    – niksmac
    Mar 20, 2015 at 6:41
  • have you tried any sort of Captcha for anon users?
    – Geoff
    Mar 22, 2015 at 13:15

1 Answer 1


Assume a setup like so:

  • Assume that for site access via Services you use an account called "ServicesUser".
  • Create a new role, say you call it "ServicesOnly".
  • Make sure that there are no other "custom" roles in your site apart from anonymous, Authenticated and Administrator (if there are any: remove them again).
  • Authorize only user "ServicesUser" for this role "ServicesOnly".
  • Tune your permissions where appropriate, so that:

    • No permissions are granted to Anonymous or Authenticated.
    • All permissions are granted to Administrator (but only in case you have a need to ever login without using services, with a userid different from user/1, if there is no need for that, then no permissions granted to Administrator either).
  • Granularly issue permissions to role "ServicesOnly", so that "ServicesUser" receives appropriate permissions whenever required.
  • Whenever the site is switched to maintenance mode (eg to apply Drupal updates), ServicesUser will not be able to login either, which is what you should want also.

With a setup like above, access via Services (and userid = ServicesUser) should work as desired. While I cannot think of any other user who can do anything on your site, except user/1 (and optionally some other user who has access to role Administrator).

With this configuration, these are the only ways around it that I can think of:

  • Some security issues that are exploited somehow.
  • Somehow getting access to the ServicesUser account

Note: no additional contributed or custom) modules needed either ...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.