I have dealt with spam problems previously with some valuable help from this forum but I've got a site that is suffering with registration spam at the moment and no matter what I try, nothing seems to reduce it.

So far I have tried; Standard EE CAPTCHA Then added a honeypot Then changed the CAPTCHA to Use ReCAPTCHA Finally added Low Anti Spam and hooked it up with Akismet

Even with all that the site is still getting registration spam so I'm wondering if there's some URL that I've forgotten about that provides a registration form or some means by which a spammer can bypass the anti-spam measures.

EDIT: Here's the registration form in case anyone has any ideas


UPDATE: I had thought I'd cracked this but noticed that Low No Spam was blocking any attempt I made to create an account (though I think this was an Akismet issue - I can't find the Typepad API registration page anymore).

So I have removed Low No Spam for now and added MX Stop Spam, Barricade and also changed the URL of the registration form.

It does look like spam registrations are getting thrown straight into the "Banned" group however my client is more concerned about the flood of notifications they get (they don't seem to want to simply turn notifications off). So I am still trying to find a way to just stop the form being filled in by spammers. I realise this is a big ask and the harder you make it the less likely real people will register but I'd be grateful for any suggestions.

  • Are you using standard EE registration templates or a plugin? If you are using a plugin, have you renamed your member profile trigger word? Commented Jan 19, 2013 at 15:44
  • I'm using a standard registration form although I have restyled it. It's under the url /register. I have also changed the member profile trigger word to a long, random string.
    – foamcow
    Commented Jan 19, 2013 at 15:45
  • I've updated my response below. Commented Jan 20, 2013 at 14:14

2 Answers 2


You've taken some good steps. While it's possible to stop all registration spam, you can probably reduce it a fair amount. One thing I notice is your registration url is very easy to get to. Most automated spam registration scripts/bots will easily be able to guess /register as a link. Having something slightly more obscure could help, like /book-lovers/register or maybe even /pccs-register.

I prefer ReCAPTCHA to ExpressionEngine's built-in CAPTCHA system, but generally speaking try to avoid captchas.

With Low NoSpam, I'd say also take a look at Barricade.

The Blacklist Module and your .htaccess file can also help in these battles. We use the 5G Blacklist updated annually by Perishable Press. It's chocked full of goodness, but be careful, you may have to comment out some rules that interfere with your set-ups behavior. For example: we modify this statement:

RedirectMatch 403 (\,|//|\)\+|/\,/|\{0\}|\(/\(|\.\.\.|\+\+\+|\||\\\"\\\")

the statement that disallows commas in the url, since we use Tags, and want to allow 2 or 3 combinations, but NOT unlimited combinations. The biggest boost this provided is just not allowing known spam bots to even hit the site.

CloudFlare is also good for this as well. It provides an all around extra security boots for the site, while improving site speed.

So make sure Blacklist is properly configured, that you look into the 5G Blacklist, and potentially use a CDN like Cloudflare as well.

That said, a lot more registration spam these days are created by actual people, who've created real email addresses. The get paid through services like Amazon Mechanical Turk to complete registration forms. It's still spam, but powers through CAPTCHA's, challenges, and other prevention methods.

Read this article on Fighting Registration Spam. What's true about it is that almost 99% of our registration spam have usable email addresses. Meaning that, even though we do self-activation, those activations don't bounce. We use Mandrill to monitor the normal black hole that is CMS email transactions. We thought that registration emails would have a high bounce rate, for one of our clients, because they have close to 70,000 registered members, and many of them are obviously just spam accounts.

Just remember, common names like register can be easily targeted via bots, especially if they are in strategically known locations, such as /register, member/register etc. So change the trigger (which you've done, but change the page name as well. If you are using something other than the default EE registration, like Authenticate or Safecracker Registration, Users, Zoo Visitor, etc., you can adjust the file name to whatever you like.

But also remember, now days you are mostly combatting humans, so beef up your overall security. Use blacklist, and .htaccess to other tools to help.

Update: Dealing with Client Notification There is no way to successfully stop all spam. Any method that you find today, will eventually be cracked and attacked. Obviously, having systems to combat spam is good, but the real problem seems to be the client's need for notification. They don't want ALL notification, they really only want good notification. Which means, you don't want to send pending or banned notifications, rather just successful activations (those could also be spam, but it would be far less email).

I'm not certain of any system that does this outright. Possibly PostMaster could be used to do it. Otherwise, I'd look into seeing if you could combine Registration Codes with MX Notify Control to get something closer to what you need.

Otherwise, its just important to let your client know, they can't stop spam. Unless they want to turn their site into an invite only registration system, which I'd assume would hurt sales. Make them understand, the more complicated they make it for the 'purchaser' the higher the abandon rate. If you have Google Analytics set-up, you can create a funnel and provide data.

Ultimately, the site, by some fluke, could get 50-100, legitimate or semi-legitimate registrations per day, that don't turn into purchases or subscriptions. Do they really want to deal with all those notifications?

Some clients won't see reason, but it doesn't mean we shouldn't try to make them do so. It also means sometimes you have to say, 'this is the best we can do…' I can't stop your spam problem, I can ONLY reduce it.

  • Some truly excellent tips there. I think I may try the 5G Blacklist, of which I was unaware, and changing the URL, which I had considered already. For the moment I seem to have stopped the flood so I'm going to give it 24 hours to see what happens.
    – foamcow
    Commented Jan 19, 2013 at 21:22
  • Yes, your update is pretty much the way I'm thinking. Will talk to them next week to see what we do next.
    – foamcow
    Commented Jan 20, 2013 at 14:23

Some ideas to try...

  • Remove all footprints in the registration and forum templates as per this article.
  • If you are using a custom registration form in an EE template, remove the one in the forum header so all your registrations go through the custom form. It's possible the one in the forum isn't using your captcha methods.

  • Try Snaptcha addon. Lots of regular positive feedback for this addon via Twitter.

  • Change the location of the registration template you have in place to a new URL.

  • Change the forum trigger word to something new.

  • Checkout this addon, MX Stop Spammers.

  • Add this addon, Members, to easily spot spammers.

  • Take a look at Project Cerberus.

  • Forum header? I'm not using the forum module. Does this exist anyway?
    – foamcow
    Commented Jan 19, 2013 at 17:55
  • Sorry... Misunderstood. No, it doesn't exist if you aren't using the forum.
    – Anna_MediaGirl
    Commented Jan 19, 2013 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.