I have multiple spam bots that try a couple hundred times a day to access my website and post comments. I have reCaptcha installed and somehow they are able to register, and sometimes actually post spam. I also have the honeypot module installed. What is the best way to stop this?

  • 1
    Mandatory link to the Spambot module – Clive Jan 4 '13 at 13:36
  • @Clive I would accept your answer. but you posted it as a comment – crh225 Jan 4 '13 at 14:11
  • No worries, I can't really flesh that one-liner out into an answer anyway, I just added the link as an alternative module. FWIW that module works really well – Clive Jan 4 '13 at 14:12
  • @Clive I have just now installed it and I like the fact it finds users and deletes them for me if they somehow get in – crh225 Jan 4 '13 at 14:13

The alternative I can suggest is the Mollom module, created from Dries Buytaert, and which uses a service provided by Mollom BVBA, an Acquia company, both co-founded by Dries Buytaert.

Mollom may block a post outright if it is from a known spammer. If Mollom is unsure how to classify a post, it may require the completion of a CAPTCHA to accept the post. Posts that do not match a "spammy" text pattern and do not originate from known spammers are accepted without the need to complete a CAPTCHA. Essentially, Mollom acts as a proactive content moderator that is on the job 24 hours a day, 7 days a week.

If you want to read a negative opinion, you can see What's wrong with Mollom?

Before mentioning reactive solutions, I feel obliged to throw out there that locking things down as much as possible is one key. If it's not a community site, you can hold comments for moderation and prohibit new registrations without admin approval. Then anything that gets through is because you've fallen behind on some security update.

As for the anti-spam otpions in Drupal...

In brief, I like to see CAPTCHA solutions as a last-ditch effort. Automated CAPTCHA solvers are cheap and CAPTCHA solving services that hire employees to solve captchas will solve them in an avg of 20 secs and are under $10/10,000. Meanwhile, the captchas have gotten so damn hard to read, that I often take six tries. It's a losing battle - in another couple of years, I am convinced that automated captcha solvers will be superior to humans at this task and they will serve only to annoy real visitors.

Drupal has so many modules that let you stop spammers by requiring "proof of work", by comparing to a blacklist, by analyzing behavior or whatever that I rarely use captcha with Drupal.

I'm new at Stack Exchange and I don't know if it's allowed to link to our own blogs, but I did a pretty long, one might say overly verbose (but hey, it's for my reference, nobody is forcing you to read it), blog post on some of your options and my subjective, ill-considered and quite possibly wrong opinions on them. Here's my list:

http://raisedbyturtles.org/stopping-spam-comments-in-drupal-7/

I should add that since I made up that list, I've also started using Cloudflare which integrates nicely with Drupal with the optional Cloudflare module. This stops a lot of attacks before they even get to your sever. For those that don't know, it's a reverse proxy service and so before they even forward the request onto your server, if the IP is in their list of known spammers, they block it there. I have been using Cloudflare for a couple of Drupal sites and at least one Wordpress site and am very pleased. The one thing to be aware of is that if it's an e-commerce site, using Cloudflare (or any similar reverse proxy on a separate server) will require you to buy an additional SSL/TLS certificate. Other than that, it's the simplest plug and play thing and blocks a lot of spambots (now I have to remember to update my spam module page to include that!)

  • Just to give you an idea of what Cloudflare does, here's a recent report for one site: Page views: 12,184 (6,105 regular traffic; 910 crawlers/bots; 5,169 threats). Unique Visitors: 2,212 (151 unique crawlers; 991 unique threats). 1.1 GB bandwidth saved by CloudFlare. 2.1 GB total bandwidth. – ergophobe Jan 4 '13 at 17:52

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.