Spam Bot Member Registrations in ExpressoStore

Question

I am running Expresso Store on the following site: https://peopleplacestraining.org

Everything seems to be working well, except for one thing…we're getting several spambot user registrations a day from the member registration portion of the checkout form. They're not even going through the order process - they're somehow creating members through the backend.

I have Snaptcha enabled on our site, but because the form used by Expresso Store is not the kind of form Snaptcha seems to recognize, it doesn't work. It just gives the error message even though I'm testing the form as a legitimate user, and have verified that Javascript is enabled.

Next, I tried adding two hidden fields and using PHP to render an error message and a blank page (instead of the order confirmation screen) if those two fields are populated, but I couldn't get it to render the page correctly (it was either totally blank or showed both the error message AND the order confirmation page).

Can someone please explain to me how I'm supposed to prevent Spambots from registering as members on my site using your product? Shouldn't this be a little more secure?

Answer 1

ExpressionEngine automatically creates a 'member' area on each standard installation, by default this is /member/.

Looking at your site I would say the spam bots are registering through the generic /member/register URL -> https://www.peopleplacestraining.org/member/register

In the ExpressionEngine control panel, under Members -> Preferences -> Profile Triggering Word you can change the value from 'members' to something else, which change the URL of your automatically generated members pages. For example changing the triggering word to users would make /users/register the new valid URL -- This MAY help curb some spam.

But, I've noticed that you are using the /members/login portion of the members templates, and if you change this then the Spam bots will detect your new triggering word and start spamming through that -- I've experienced this myself.

I have no good work around for this. You can set the Profile Triggering Keyword to # which will disable it all together. Unfortunately this will also disable your current login pages.

My suggestion is to use Profile:Edit or another plugin from devot-ee.com to handle the login and forgot passsword features.

Update: as suggested by @peter-lewis you could block block the member area with .htaccess

The other option is to hack the index.php and simply exit(); whenever the $_SERVER['REQUEST_URI'] == '/members/register'

Good luck!

Answer 2

Given that Store doesn't let you register members without creating an order, and you mentioned that these spam registrations aren't creating orders, it's almost certain that these registrations aren't coming in through Store.

Also, captchas aren't necessary with Store, because no spammer in their right mind would bother going through a credit card payment just to sign up a member on your site or place a fake order :)

It sounds like the question above helped you find the cause of the problem. Just wanted to add that it's unlikely Store was the cause of the problem here in case other people are running into similar issues.