CODEWITHSUNDEEP
phpspam
Themis Beris
Themis Beris

Reputation: 990

Spam prevention from Humans/Bots

I am struggling these days to prevent spam from my signup form. I do not want just to prevent it from bots (with honeypots etc) but when a real human writes a script designed for my website to fill my database with dummy registrations(i do not want to use captcha). I have the following things in my mind to implement about it:

  1. Check if email addresses exist (not only valid).I have read that you may be banned if there are lots of requests.Moreover it is possible that the script can contain valid email addresses (for instance when a university provides students email that are slightly different).

  2. The other solution is to make a comparison between IP/Time_of_request and in case the same IP gives lots of requests for signup, consider user as spammer. For this you can set a threshold that you can consider signup request as spam. The problem here is that the script may find the threshold (e.g. 1 second ) and send request every 1.1 seconds. Moreover someone may use onion routing(?) and i will not be able to ban him.

3.What do you think about random input names ?

So what practices here are considered to be good enough to come through this situation?

Thanks!

UPDATE

I send email with confirmation link for activation,but i give users the feature to use the site for about 4 days without activating their accounts! I do not want in first step my database to have spam accounts!

SOLUTION

For everyone interested in, i used honeypots combined with a temporary database ! It seems to work fine!Thanks!

Upvotes: 1

Views: 439

Answers (3)

Trick
Trick

Reputation: 646

In Response to OP Update: If you need to give users the option of using the site without clicking the activation link for X days, perhaps you could also send a set of two 4-digit (or just 6, but not secure) PIN numbers in the email (or separately) and have them use that as their temporary password until the account is activated via the original email link. In your database you'd notice if the PIN was used or not, indicating if it was a spam account. It could even be a one-time-use PIN.

Upvotes: 1

Laur
Laur

Reputation: 133

To validate the email address you could send a confirmation email with a validation link and the user should click on that link to confirm that is his email address and is not a boot.

Upvotes: 2

GoalDone
GoalDone

Reputation: 343

One more thing you can create a temporary registration database, and if someone verify email in 24 hours of registration, his/her data will moved to main registration database. and every entry will be deleted in 24 hours if email is not verified by user.

Upvotes: 3

Related Questions