I've made a site where users can create accounts. Lots of spam accounts are being created and I am not sure why. The form at mysite.com/user is mollom CAPTCHA protected, what other paths should I check?

3 Answers 3


Mollom tests content for spam. But user creation form does not provide any opportunity to provide spam content in the first place. So you have 2 strategies available:

  1. Protect user creation form with more traditional captcha, or one of it's mutations like reCaptcha or little game humanity test.

  2. Protect comments / node forms with Mollom and automatically block users that will fail mollom test there.

Note, above ways are not mutually exclusive.

  • Ive used mollum for CAPTCHA protection. Ive updated my question this this info.
    – Evanss
    Aug 28, 2013 at 11:04
  • Simple Google search for "when mollom shows captcha" shows that it's very buggy on Drupal. Maybe time to consider another captcha provider? Or post an issue in their queue, if you are paying customer.
    – Mołot
    Aug 28, 2013 at 11:08

Well, in that case Spamicide Module is a gift to get rid of spam posts and spam accounts.

Spamicide adds an input field to each form then hides it with css, when spam bots fill in the field the form is discarded. The field, and matching .css file, are named in such a way as to not let on that it is a spam defeating device, and can be set by admins to almost anything they like(machine readable please). If logging is set, the log will show if and when a particular form has been compromised, and the admin can change the form's field name (and corresponding .css file) to something else.


Try the Spambot module which makes use of stopforumspam.com's database of known spammers.

Spambot protects the user registration form from spammers and spambots by verifying registration attempts against the Stop Forum Spam (www.stopforumspam.com) online database. It also adds some useful features to help deal with spam accounts.


Checks (username, email, ip address) data against the www.stopforumspam.com blacklist. Blacklisting can be based on either of email, username or IP address (with configurable thresholds).

You could also make use of projecthoneypot.org

Project Honey Pot is an open source initiative to track abuse, fraud, and other malicious behavior that occurs online. The Project tracks more than a million IP addresses engaged in suspicious behavior each day and reports on them through our website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.