I have multiple spam bots that try a couple hundred times a day to access my website and post comments. I have reCaptcha installed and somehow they are able to register, and sometimes actually post spam. I also have the honeypot module installed. What is the best way to stop this?

  • 1
    Mandatory link to the Spambot module
    – Clive
    Commented Jan 4, 2013 at 13:36
  • @Clive I would accept your answer. but you posted it as a comment
    – crh225
    Commented Jan 4, 2013 at 14:11
  • No worries, I can't really flesh that one-liner out into an answer anyway, I just added the link as an alternative module. FWIW that module works really well
    – Clive
    Commented Jan 4, 2013 at 14:12
  • @Clive I have just now installed it and I like the fact it finds users and deletes them for me if they somehow get in
    – crh225
    Commented Jan 4, 2013 at 14:13

2 Answers 2


The alternative I can suggest is the Mollom module, created from Dries Buytaert, and which uses a service provided by Mollom BVBA, an Acquia company, both co-founded by Dries Buytaert.

Mollom may block a post outright if it is from a known spammer. If Mollom is unsure how to classify a post, it may require the completion of a CAPTCHA to accept the post. Posts that do not match a "spammy" text pattern and do not originate from known spammers are accepted without the need to complete a CAPTCHA. Essentially, Mollom acts as a proactive content moderator that is on the job 24 hours a day, 7 days a week.

If you want to read a negative opinion, you can see What's wrong with Mollom?


Before mentioning reactive solutions, I feel obliged to throw out there that locking things down as much as possible is one key. If it's not a community site, you can hold comments for moderation and prohibit new registrations without admin approval. Then anything that gets through is because you've fallen behind on some security update.

As for the anti-spam otpions in Drupal...

In brief, I like to see CAPTCHA solutions as a last-ditch effort. Automated CAPTCHA solvers are cheap and CAPTCHA solving services that hire employees to solve captchas will solve them in an avg of 20 secs and are under $10/10,000. Meanwhile, the captchas have gotten so damn hard to read, that I often take six tries. It's a losing battle - in another couple of years, I am convinced that automated captcha solvers will be superior to humans at this task and they will serve only to annoy real visitors.

Drupal has so many modules that let you stop spammers by requiring "proof of work", by comparing to a blacklist, by analyzing behavior or whatever that I rarely use captcha with Drupal.

I'm new at Stack Exchange and I don't know if it's allowed to link to our own blogs, but I did a pretty long, one might say overly verbose (but hey, it's for my reference, nobody is forcing you to read it), blog post on some of your options and my subjective, ill-considered and quite possibly wrong opinions on them. Here's my list:


I should add that since I made up that list, I've also started using Cloudflare which integrates nicely with Drupal with the optional Cloudflare module. This stops a lot of attacks before they even get to your sever. For those that don't know, it's a reverse proxy service and so before they even forward the request onto your server, if the IP is in their list of known spammers, they block it there. I have been using Cloudflare for a couple of Drupal sites and at least one Wordpress site and am very pleased. The one thing to be aware of is that if it's an e-commerce site, using Cloudflare (or any similar reverse proxy on a separate server) will require you to buy an additional SSL/TLS certificate. Other than that, it's the simplest plug and play thing and blocks a lot of spambots (now I have to remember to update my spam module page to include that!)

  • Just to give you an idea of what Cloudflare does, here's a recent report for one site: Page views: 12,184 (6,105 regular traffic; 910 crawlers/bots; 5,169 threats). Unique Visitors: 2,212 (151 unique crawlers; 991 unique threats). 1.1 GB bandwidth saved by CloudFlare. 2.1 GB total bandwidth.
    – ergophobe
    Commented Jan 4, 2013 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.