I have a free site with open registration; anyone can register and I am not able to change that. However, accounts must be approved by an administrator after completing a profile, so I have access to a variety of info to identify duplicate users (date of birth, "self introduction" comment, email address, photos, reported location in profile, geolocated IP, IP address, etc.)

Recently the site has become subject to the attacks of a single user who is extremely abusive and seems to have unlimited time to register multiple accounts. These accounts can be blocked relatively easily, but it's a lot of work for the administrator (me) and I'm afraid I will miss one among the legitimate accounts (this user registers about 6 accounts per day).

I have already:

  • banned the user's known IP addresses
  • blocked registration from known domains that are used for "disposable" email addresses
  • added a special view to help me identify accounts based on known patterns of access from the user

Is there anything I can do with cookies, etc. to make it even more difficult for this user to register?

This is a Drupal 7 site.

EDIT: In my case, this is a human user, not a bot. But the bot answers are useful for those who are being specifically targeted by spammers.

  • The only thing that I can think of would be those annoying captchas that are really hard to read, as some of the letters/numbers you think they can be two things, and you have to try like 5 times to guess it correctly. On the negative side, you will annoy everyone else, lol.
    – No Sssweat
    Commented Feb 17, 2016 at 4:43
  • 13
    drupal.org/project/misery if all else fails. Commented Feb 17, 2016 at 5:09
  • 7
    Actually the first two solutions you have used are quite bad ideas. IP addresses are very inadequate at uniquely identifying even an entire network, never mind a specific computer, and never mind a specific user! It is not uncommon at all to have a user share a device with many other users, where that device is on a network with many other devices all sharing a single IP address, which is regularly reallocated by the service provider, to different customers. Banning entire sets of email domain names is even worse. You run a real risk of blocking a legitimate user.
    – JBentley
    Commented Feb 17, 2016 at 16:54
  • 4
    When trying out the advice in answers I would suggest never making the lives of your good users less pleasant for the sake of punishing bad users. If you do this the bad users have won and you risk losing good users.
    – rooby
    Commented Feb 17, 2016 at 23:33
  • 2
    – starblue
    Commented Feb 18, 2016 at 19:47

12 Answers 12


Instead of trying to prevent the user from registering, which is a game for trolls and hackers alike, make the site annoying for him. Make him want to leave, as opposed to making him want to win the trolling game.

What I've done in the past, not specific to Drupal, is to let the user register. I then sabotaged his specific account:

  1. I sprinkled if ($someuser) { sleep(rand($base, $base*2)) } in the code, where $base would increase daily. I made sure that he had lots of timeouts.
  2. I would drop N% of his posts, where N started above 50% and only increased from there. If the post had certain keywords, it would be dropped immediately.
  3. I would randomly drop CSS rules so the page would display poorly. Again, the severity would increase in time.

This required more effort on my part, but as per Sun Tzu's advice I was conditioning the user to hate my site. I wanted him to feel not that he was annoying us, but rather that he should be annoyed by the delays and apparent bugs. It took less than a week for him to give up on us.

EDIT: In the comments, user rooby mentions the Misery module which is based on the same concept:

  1. Delay: Create a random-length delay, giving the appearance of a slow connection. (by default this happens 40% of the time)
  2. White screen: Present the user with a white-screen. (by default this happens 10% of the time)
  3. Wrong page: Redirect to a random URL in a predefined list. (by default this happens 0% of the time)
  4. Random node: Redirect to a random node accessible by the user. (by default this happens 10% of the time)
  5. 403 Access Denied: Present the user with an "Access Denied" error. (by default this happens 10% of the time)
  6. 404 Not Found: Present the user with a "Not Found" error. (by default this happens 10% of the time)
  7. Forms don't submit: Redirect back to the form during validation to prevent submission. (by default this happens 60% of the time) Note: Occasionally certain forms validate based on which button was pressed, this won't work in those cases.
  8. Crash IE6: If the user is using Internet Explorer 6, this will crash their browser. (by default this happens 0% of the time)
  9. Spam: Replace node content with a set word. (by default this happens 10% of the time)
  10. Logout: Log the user out. (by default this happens 10% of the time)
  • 8
    I think this is great in theory, but the thought of hardcoding $someuser every single time they create a new account makes me cringe. Still, great idea. Maybe just adding a field in the accounts table, like a troll column. If it's 1, the changes take affect. Then add a simple interface for marking someone as a troll. At least that way it's a bit easier than hard-coding a username/user id/email/etc. every time they register under a new account. Upvoting this for sure, though.
    – Nate I
    Commented Feb 17, 2016 at 20:22
  • 5
    @NateI you can make it reusable though. if (hellbannedUsers.contains($someuser)) is a step better. I just don't like how much homebrewed logic this is in the first place, but it can at least be made reusable.
    – djechlin
    Commented Feb 17, 2016 at 22:23
  • 3
    @djechlin Of course it can be made reusable, hence my own comment about taking it a step further with a table in the DB.
    – Nate I
    Commented Feb 17, 2016 at 22:34
  • 3
    You might be interested in the misery module to save yourself some coding.
    – rooby
    Commented Feb 17, 2016 at 23:39
  • 7
    Great answer. A variant on this is to let the troll post, and show the posts to that user, but hide them for all other users.
    – zelanix
    Commented Feb 18, 2016 at 12:40

Email The Abuser's ISP - They Will Put An End To It!

You have a log of his account creation times, and the IP addresses used to register, right? You also have a log of all of his harassing comments as well? Send these logs to their ISP.

You can find the ISP by doing an IP lookup either directly with ARIN at https://whois.arin.net/ui or another service which simply uses them for a whois. Most users will have an actual ISP come up for the owner of the IP, but some (large corporations typically) will own the IP themselves. Either way, you'll find out who it is that owns the IP, and from there you can look them up and get an abuse email address (sometimes they put an actual abuse email address in the WHOIS information, which is great) to send your email to. Be kind and courteous with the ISP. Don't write an epic novel - keep it simple. Something like, "This ip has been harassing myself and users of my website, please see the logs" will suffice. They see thousands of these a day, they don't want to read a sob story.

I used to be a Network Engineer at an ISP. We received countless harassment reports for this very kind of behavior. The moment a subscriber receives the phone call, they stop about 90% of the time. If it does continue, legal action can ensue which means most ISPs take very serious action.

Your aggressor is probably a kid living at home with his parents, which means when his parents' internet account is threatened to be terminated, they'll be incredibly upset with him for his behavior.

I've personally taken this route and it does work, even if the aggressor is not in your country. ISPs do NOT take kindly to users being abusive on their network.

Side Note

There's the possibility he is using a Proxy. However, it is very unlikely he used a proxy upon initial registration unless he fully intended (from the moment he registered) to troll on your website. If none of the IPs actually point to a legitimate ISP where you can actually send an abuse email, try sending it to whatever Proxy service he's using.

People have this crazy idea that simply because someone's using a Proxy, they're undetectable. That's false. Proxy services typically follow the same rules everyone else does (of course there are exceptions). When they get an abuse report, they take care of it just like an ISP does.

On the incredibly small chance that this user is behind a Proxy that doesn't play nice, I'd follow the advice of the other answerers. Seriously though, that's so rare that most website owners will never see an attack from someone who's seemingly "undetectable".

  • 2
    This is the only actual solution. Everything else that has been proposed appears to be workarounds, not solutions.
    – user
    Commented Feb 18, 2016 at 10:51
  • Tor can also be a problem in this regard, but if you are really having trouble with this, there is always the option of blocking traffic originating from Tor exit nodes only. (That last keeps the collateral damage to a minimum.)
    – user
    Commented Feb 18, 2016 at 10:53
  • Can you give me any idea how long this process might take? I sent the information in 10 days ago and I have yet to get a response of any kind, even an acknowledgment of my report. Commented Feb 27, 2016 at 0:49
  • I've never received an actual response. The only thing I've ever witnessed from this course of action is the person just stops what they're doing. Is the person still harassing you and users of your website?
    – Nate I
    Commented Mar 3, 2016 at 17:04

On your question, you do not mention having a Captcha. Perhaps, this anoying user is a bot? My guess is that you already have a captcha and that user is actually human.

But... if that's not the case, I would recommend:


Uses the Google reCAPTCHA web service to improve the CAPTCHA system and protect email addresses.

enter image description here


Hellban / shadowban

As blocking a person from creating new accounts to replace blocked ones is nearly impossible, a somewhat popular solution to this problem is the so-called hellban (http://www.urbandictionary.com/define.php?term=hellban) or shadowban, where you implement a feature that isolates certain accounts from everyone else without making it obvious that they have been banned.

For example, you would make sure that they feel like their experience is genuine and they can keep using the same accounts, but make a condition that any of their posts or activities are visible only to hellbanned accounts and any accounts (or not-logged-in situations) that share IP and/or cookies with the hellbanned account. If the user continues to troll but gets no response, then they will leave eventually.

  • How to implement this in Drupal 7? Commented Feb 19, 2016 at 13:23
  • 1
    @reinierpost - Cave is one option to implement this
    – BryanH
    Commented Feb 19, 2016 at 16:53

At No Sssweat's suggestion, I'm putting this as an answer instead of a comment so more people see it.

Drupal.org/project/misery does quite a good job of annoying the crap out of a user with about eight different methods. Random time outs, log outs, random redirects etc. and the frequency is changeable.

An easy version of dotancohen's nice write up to the problem.


It is actually impossible.

You cannot stop a person from registering again and again. The only thing you can do is harden the registration process and double/triple-checking their ID (through email address and google account and facebook account and LinkedIn account and phone number, and so on) and correlate each person with a specific ID that aggregate all these details.

The specific person can either pick another network through web proxy, create many @email, open several facebook/google/LinkedIn account and so on, but you will never be able to stop this person to register again (unless you check its DNA).

Your only choice is to harden the registration process.

  • 2
    As I said, demand your future-new users to bind their account with a unique facebook account and a unique google account and a unique LinkedIn account and a unique phone number to which you send an SMS. You're in a very though position! You cannot, without really expensive means, assure that a user register only once. Moreover, the only means that you can use would annoy your future users (who is well-willing to bind ggl/SO/fb/LinkedIn/GH account + send their ID by postmail, just to create a new account?)
    – Auzias
    Commented Feb 17, 2016 at 14:01
  • 11
    This is a fast way to reduce your number of genuine users too.
    – Tom Bowen
    Commented Feb 17, 2016 at 15:05
  • 3
    You're arguing that it's impossible in the worst case, i.e. if an advanced intelligence agency with billions of dollars is out to get you. There's a very good chance the OP is dealing with like a bratty 11 year old somewhere. So your answer is both a bit impractical, and IMO misleading.
    – djechlin
    Commented Feb 17, 2016 at 22:37
  • 2
    Your answer contradicts itself. It says you can't, then the only way you can is by hardening the registration process, which actually will not necessarily solve the issue and also is not the only potential solution.
    – rooby
    Commented Feb 17, 2016 at 23:31
  • 1
    I do know ;) or don't have google, nor LinkedIn
    – Auzias
    Commented Feb 19, 2016 at 8:22

How about using a second factor? In your registration, say you'll send an SMS to their phone or an email and ask they confirm their registration by clicking a link and sending the info back. You'll acquire a harder to spoof identifier than IP address and it may be easier to filter him out that way. Obviously will require some small amount of scripting...


As suggested by No Sssweat, you can use reCAPTCHA. But if incase you don't want to annoy legitimate users, then you can try Honeypot module. It gives the option of having an extra field which shouldn't be filled (AFAIK bots may fill all fields) or have time restriction.

Documentation reads as,

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site (read more here). These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user [YouTube].

Another option is Spambot module, it prevents spam by verifying registration attempts against the Stop Forum Spam.

Spambot protects the user registration form from spammers and spambots by verifying registration attempts against the Stop Forum Spam (www.stopforumspam.com) online database. It also adds some useful features to help deal with spam accounts.


There is an answer to the question - albeit that the community may find this offensive. I don't know why, save cost, that the path has not been taken more often.

Send a cease and desist letter to the individual who is trespassing on your site, and who is violation Title XVIII of the US Code, Tampering with Computers, Fraud and Abuse.

If they don't cease, pony up the cash and sue. In the mid 1990's I had the first case in the WDMO where the sole ISP for the Kansas City area was hacked by 3 teens. I contacted the families (they had rooted one of the servers and were stupid enough to store their application to join "Warez" groups with their real names and addresses in a hidden subdirectory) and asked them to stop the adolescent boys from doing this. They refused.

In a 54 page complaint I had to explain: ISPs, Internet, exceeding access, etc. to a newly appointed judge.

I was more than an advocate, an account of mine had been accessed (thank god, not a client account - The Rust List) and I was ticked off. I charged the parents (only way to go where defendants were minors in a civil action) and stated that the parents had placed a dangerous instrumentality into the hands of minors without adequate supervision and that the minors had engaged in the transfer of stolen software, and kiddie porn (Yep, 16 year old boys taking pictures of their 16 year old GF's is "kiddie porn"). I hit the homeowner's policies and I had a remedy that the courts in those days would not even consider: a lifetime ban on the use of computers for the teenagers.

It got settled within a week of the transfer of discovery.

You have tried everything else: hammer this little shit with a walletectomy. Be careful to pick an attorney who knows what this is and not one associated with a "big firm" where you will be billed to death.

Consider how a court order precluding the jerk from accessing your site might work: S/He's banned - you find an IP address of his/her violating the Court Order - send it to your attorney and s/he files a motion with the Court showing violation of the Order and the Court will respond with a Show Cause Order why the defendant should not be held in contempt of court.

An attack from other sites/IP addresses start coming in - tell your counsel - and the response can include mirroring the defendants computers, an injunction stopping the defendant from all access to the Internet, and, upon finding that the defendant violated the order by proxy, the Court will impose sanctions.

Ultimately, the jerk may have confined himself to forever be blocked from the Internet. If you are truly pissed off after all of this and you want to be certain that the defendant is off the Internet, hire a PI to follow the defendant for a week or ten days (not cheap) and if s/he is accessing the Internet from a Starbucks - or McD's you have them: back to the judge.

The ultimate Order is beyond belief and will only happen with overwhelming evidence that the defendant had routinely violated the court's orders: no smart phones, no VOIP, no cable or sat TV (Internet is available and s/he has shown a total disregard for the law, so nothing that they can hack to gain access is permitted), no Internet (it would be nice if it were a lifetime ban - likely not), no Internet of things, and ultimately, no computing devices.

If the defendant was making their living in the tech sector - they have ditches to dig and burgers to flip.

That's how to end this with the nuclear option.

  • @Pierre.Vriens This is interesting information in any case, and while I am in Tokyo, my company is in the US, as is the abusing user. Commented Feb 19, 2016 at 16:55
  • OK, sorry for my comment then (I've deleted my prior comment just now already then) ... I am looking at it with EUR-glasses though ... Commented Feb 19, 2016 at 16:56

I like the misery model, but I would add to randomly send him to a page with really loud annoying messages and other times send him to really bad porn sites. Anything that might get him in trouble or embarrassed if he is in public.

  • 1
    Desperate times call for desperate measures, this would be so annoying. I might add redirect him to Rick Roll, lol.
    – No Sssweat
    Commented Feb 18, 2016 at 15:21
  • 1
    That would give out that he is blocked
    – Ángel
    Commented Feb 19, 2016 at 23:20

I have written a module specifically for this kind of situations. It is called Spaces Enforced and can be found here, and works by blocking any registering person whose name doesn't contain at least 1 space. It can be further configured and you can select what character needs to appear how many times. It also has a succession rate of close to 100%


Disable registration form /user login page Account Settings - /admin/config/people/accounts -> under Who can register accounts?, check only admin

  • This site gets about 100 legitimate users a day; doing it this way would impose a major burden on the admins. Commented Jul 27, 2020 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.