Like many people who run e107 websites, the constant stream of spambots are driving me mad.
I've tried CAPTCHA and the rest but they always seem to get through. So I've been thinking, and checking my server logs to see exactly what they are doing. Most seem to follow the same path
- Visit the home page (get request)
- Go to /signup.php (post)
- Read captcha image
- Go to /signup.php.activate etc (post)
- Read comments/news and start spamming
I also noticed on the stats log that error 404 requests had been made to /index.php?login= (for example) and other pages which that dont exist on e107. They were in fact login attempts for other CMS's. So my thoughts are, if they visit my site and check for the standard /signup.php and customsignup.php and dont find it, they wont auto register.
With e107 this was a fairly simple task. I changed a website a week ago, renaming all signup.php files to another name, and since then I've had zero spam registrations (touches wood) while on others I have. I've just implemented and tested this on a second website in about 10 minutes.
Heres what to do... remember you are modifying your core e107 files so always back up before editing and its your own risk. The instructions are for 0.7.17, but the CVS may differ slightly in terms of line numbers.
Signup instructions here...Hope this helps, it did for me.