Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It only takes a minute to sign up.
Sign up to join this community
I administer a website which does not require users to register. The only user that is needed is the Super User. The problem is that I found a large number of new registered users.
First I want to disable the ability to register new users and delete existing ones, except Super User.
For a start I made some steps, I installed two verification steps in a try to block and delete users.
I faced a problem when I tried to erase or block users, nothing happened without displaying any error.
Newer versions of Joomla 3.x disable User Registration by default.
If your version of Joomla was installed before this change, you probably have User Registration enabled.
User Registration can be disabled by setting Users -> Manage -> Options -> Allow User Registration to "No".
You can then delete all users except the Super Administrator account.
The majority of such registrations are coming from botnets, infected machines, script kiddys and generally all kind of bots.
In systems like Joomla, where the location of the user registration form is well known and by default public accessible, it's easy to start filling up and submitting the forms.
Actually in today's internet world, this is something that is happening continuously and in super-high volume in all kind of web-forms (forums, comments, contact forms, registration etc).
There are a few ways to protect a Joomla site against such activities. At first, if you don't need Users to register in your website, you could disable the User Registration, in Users Configuration (Users->options->Allow User Registration set to No).
In addition to this, or in the case you do actually need to have Users Registration enabled, here are some techniques and suggestions to protect your various Joomla forms from spammers, spambots and hackers:
Joomla comes with a native captcha plugin. You can find it inside Plugins, search for: Captcha - ReCaptcha. Inside the plugin there are instructions on how to set it up. You will also need to obtain an API key from https://www.google.com/recaptcha/.
Joomla Documentation on reCaptcha
There are many good Joomla form extensions out there. Many of them provide integration for the user registration. You can build your own custom registration form and add 1 extra hidden field, with a validation against being completed, or by processing the POST data of the form. Your users will never see the hidden field, but bots will try to complete this field as well - but then your validation will fail, or if you are processing the post data, you could redirect to a 403 Forbidden page.
For this solution to work completely you will need an extra plugin, that will handle redirection for all registrations to your custom form.
Admin Tools, RS- Firewall and there should be more... are extensions that provide thorough firewall protection against this and more security concerns. For example with the Admin Tools pro you can inject hidden fields in all existing forms of your Joomla site and block the IPs from where a submission is coming from. Futhermore Admin Tools provide integration with HoneyPot project and GeoIP blocking features by country, among other features.
Http:BL is a system that allows website administrators to take advantage of the data generated by Project Honey Pot in order to keep suspicious and malicious web robots off their sites. Project Honey Pot tracks harvesters, comment spammers, and other suspicious visitors to websites. Http:BL makes this data available to any member of Project Honey Pot in an easy and efficient way.
There are many software applications that provide ProjectHoneyPot integration. For Joomla some extensions are: Admin Tools Pro and sh404SEF.
Enhance the security of your Joomla application with this free php security script. It is designed to detect certain behaviors detrimental to websites, or known bad addresses attempting to access your site. It then will send the bad robot (usually) or hacker an authentic 403 FORBIDDEN page with a description of what the problem was. It's possible that you might have to make some custom signatures or sign.overrides to make it work exactly for your needs, but it is very effective. Spambotsecurity.com
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^http://www.yourwebsite.com [NC]
RewriteRule .* - [F]
And a reference to a blog post with more ways to blacklisting via htaccess and mod_rewrite. https://perishablepress.com/eight-ways-to-blacklist-with-apaches-mod_rewrite/
Well there are so many cool things that you can do on the server level, using mod_security (assuming it is installed on your server). The topic is big and most likely out of the scope of this website. Also, many of the possibilities depend on your hosting type / environment, , so I will post some reference links with further information about mod_security.
