37

Check here. While it's technically possible to remove the login functionality, you shouldn't, because then your administrator could never log onto the site. In order to remove the register functionality, you simply need to browse to admin/user/settings (for Drupal 6) or admin/config/people/accounts (for Drupal 7 and 8) and select the the "...


12

On the People page (admin/people), first select the blocked users and then from the update options select Cancel the selected user accounts. (Drupal 7) Another way is using the Views Bulk Operations module.


9

I made good experience with Mollom. But you need a free registration at their site. Update: Unfortunately Mollom has announced the end-of-life for their service by April 2018.


9

Drupal file uploads (in core or modules) should use file_save_upload which itself also calls file_munge_filename. Together those two functions should ensure that even if a file contains php it is not named in a way that a typically configured webserver would execute them. They also have protection against pl|py|cgi|asp|js files which can often contain code. ...


8

This is better solved at the Apache level. The industry standard method for doing this is to create a honeypot directory, make it off-limits to bots in robots.txt, then logging the IP-address of those who still go there, and block it. For an example of this, see the this page: http://www.kloth.net/internet/bottrap.php. You can set up this on shared hosting ...


8

From my pesonal experience I can recommend you: General protection http:BL module to block most of bots from just viewing your site CAPTCHA module with reCAPTCHA or Captcha Riddler submodule (other are useless) to protect registration and password reminder forms Anonymous comments protection listed above captchas (but that will disable caching on pages ...


7

I think you were looking for an antispam module, weren't you? Try Mollom. It kills comment, contact form and registration form spam, has image and audio CAPTCHA service. Try it, it is made by Drupal core developers.


7

You can override the format specific template like views-view-unformatted.tpl.php (you can find the right file based on your requirement) and then use some custom code like <?php if (($id % 2) == 0): ?> Do what-ever you want to do here. <?php endif; ?> This module hosted on github https://github.com/pedroposada/custom_views_nthrow ...


7

According to the module documentation, you can do this: If you want to add honeypot to your own forms, or to any form through your own module's hook_form_alter's, you can simply place the following function call inside your form builder function (or inside a hook_form_alter): <?php honeypot_add_form_protection($form, $form_state, array('...


7

The version of core you're running - 7.30 - is extremely vulnerable. As long as you're running any version of core prior to 7.32, your site will remain vulnerable. The vulnerability will allow changing modules (which can be discovered with the Hacked! module), putting executable PHP in the database (which can not be discovered with Hacked!), and injecting ...


6

Open up firefox or chrome, and inspect the form (using firebug or any equivalent). If you see any element with the class 'honeypot-*' and a label 'Leave this field blank'. Then its a honeypot field and its enabled. To check if it works. Make the element visible by changing display: none to display: block, enter a value into the input box and hit submit. The ...


6

Mollom is a very useful tool for preventing spam and integrates well with Drupal and is an essential module for running a Drupal site which can get reasonable traffic. AntiSpam is also another spam prevention module for Drupal based on Akismet of Wordpress, but you need to have an Akismet account for it to work. You could also try the following ...


6

Disabling a module doesn't mean uninstalling it. To uninstall a module, once you disabled it, you need to go to admin/build/modules/uninstall (Drupal 6), or admin/modules/uninstall (Drupal 7, and Drupal 8), select one of the module listed, and click on the button to uninstall them. Since Drupal 7, every database table declared with hook_schema() is ...


6

Why not use the Flag Note module. Extends the Flag Module to allow users to enter a note when they flag a piece of content and eventually build a flag history. Usage examples: flag nodes or comments for abuse providing a descriptive reason flag users as friends leaving a hint It's possible to opt to keep old notes even when the ...


6

These are robot spam registrations. To my eye, they look like they originate from XRumer. XRumer knows how to complete the registration process of LoginToboggan and knows how to solve simple CAPTCHAs, so these measures will not stop XRumer from registering. The modules I've found to be most effective against robot spam registrations are MotherMayI and ...


6

You really don't need a CSV; all you need is the identifying column (e.g. mail or uid). To that end, you have one option with the Bulk User Delete module. This module allows you to bulk delete users through the admin interface. You provide a list of email addresses, one per line, and the users are deleted using the batch processing API. With this ...


5

Another module that does a pretty good job with spam comments (depending on your site) is Honeypot. It will also help prevent user registration and form spam.


5

The type malicious bots you describe can connect through open proxies all over the world (typically without permission), each having different IP addresses. They can also use trojans and viruses on hijacked client computers/servers to do their work. In other words, Drupal's built-in flood control system, that uses IP-addresses for blocking, is no good for ...


5

You are correct in your update that: This is a Drupal problem, in that the script must change how it sends emails. What Drupal uses in the "from" field should actually be in the "reply-to" field. This can be fixed using a hook. (Specifically, hook_mail_alter().) If you don't want to write any code, I suggest you use the Contact Reply To module by rfay. ...


5

We do OK with anti-spam and akismet.


5

What I use as pest control against human spammers are the following: I have a rule that automatically gives a user a "not a spammer" role after he/she has verified the e-mail used to register, has been a member for at least three days, and has posted at least three "ham" post (a post is assumed to be "ham" until proven otherwise). I use the Flag module to ...


5

As Shawn Conn said, the Bulk User Delete module seems like it would work. If you're looking for more of a one time quick-and-dirty solution, you could accomplish it with a shell script and Drush like so: #!/bin/sh while read username; do drush user-cancel $username done < list_of_usernames.txt See http://www.drushcommands.com/drush-7x/user/user-cancel ...


4

I have good results with Captcha module.


4

Honeypot (a module I maintain) works pretty well for small-to-medium sites in most cases. It doesn't require any extra user intervention, and catches most automated spam. It's also really fast (no expensive calculations or external API requests). It's being modified currently for use on Drupal.org, and will be much better at also catching human spammers (it'...


4

You can either force users to confirm email change or protect the email field from changes. Both modules have D6/7 versions. Second module can lock password and some other fields as well.


4

That is why Mollom exists: http://drupal.org/project/mollom Mollom may block a post outright if it is from a known spammer. If Mollom is unsure how to classify a post, it may require the completion of a CAPTCHA to accept the post. Posts that do not match a "spammy" text pattern and do not originate from known spammers are accepted without the need ...


4

There is really no silver bullet that can be used to completely stop spam. Spam can only be minimized. Spam entered by human beings will still always get through -- and there are more and more human being spam farms out there. The best solution that I have found is to work with Mollom rather than ReCaptcha. Just as @Bisonbleu mentioned in the comment. ...


4

Forms aren't implementations of anything as such, they're just plain PHP functions that happen to return a certain structure by convention. There's no registry of forms or anything like that, and the module that a form is defined in isn't tracked anywhere (it's not information that Drupal needs). Form functions don't even have to be named in any particular ...


4

I'm not sure if there is a module which does that. However, you could do that with the help of some custom coding inside hook_cron: function MODULE_cron() { // Find out the comment ids of the comments that are unpublished // and are older than 30 days. $comments = db_query('SELECT cid FROM {comment} WHERE status = :status AND created < :created', ...


4

If your site is set up to allow people to register for the site, but requires administrator approval before they're activated (pretty common set up for Drupal), then spammers will manage to register accounts, but the accounts created like that will show as blocked users until they're approved. That may explain why these blocked accounts exist. If this is ...


Only top voted, non community-wiki answers of a minimum length are eligible