I have been experiencing spamming in my website for a long time, following are two things i want to stop -

1.stopping fake/bad user registration 
2.stopping posting bad topics in my kunena forum 

I have captcha and registration confirmation email enabled when new users registers in my website, but still many fake users are registering, most of their emails ending in mail.ru and yandex.com. For this in my gmail account i am getting too many delivery incomplete and registration pending approval emails because most of those emails not exists and have many restrictions so that their registration is not being complete, i want to stop all these emails too.

I have done many researches about how to stop them, i got users' ip addresses from k2 user list and added those ips in restricted list from my server control panel but all those ips different and how long i can do that?, I found recommendations from experts to use EasyCalcCheck extension but it's not free and i can't use it after installation, also i checked akeeba admin tools extension but did not see any settings for this yet.

One thing spinning in my mind if they were using bot when registering then could they pass captcha input restriction? so some measurements like putting hidden inputs and asking to answer questions before registering may not work because they are freaky minded human registering themselves not any bot or am i wrong?

So i need very strong suggestions about what to do to stop fake/bad user registrations(6/7 registration attempts on avg each day) and posting bad topics in kunena forum(on topic posting, i set captcha challenge for users in kunena settings and tried other available settings). FYI i am using CB for registration.

Update: I think this question is not exact duplicate of any other questions(like this one), reasons are that i addressed two concerns that is not only to deal with fake/bad users but also to deal with posting bad topics in my kunena forum.Also there are differences between what I and other authors wanting to get by these questions.

There are not many posts of this kind and it does not match exactly with any questions, so just keep it so that community gets benefitted from it.

  • @ffrewin ur that mentioned question wants no user other than super user so how it is a duplicate?? Answers of ur that question mostly do not solve what i want as it discussed mostly about bots but as i used captcha so mostly bots not disturbing me, so i want to stop those frequent reg from bad users every day. Plz remove duplicate attribite on my question.
    – dev-m
    Aug 24 '17 at 17:42
  • You said you're using captcha. Are you referring to the old captcha, or the new ReCaptcha v2, by which users only have to check a checkbox?
    – Lodder
    Aug 24 '17 at 18:07
  • Perhaps also write a script that you can run via a cron job, that deletes all unactivated accounts after a week or something
    – Lodder
    Aug 24 '17 at 18:08
  • At lodder need to check captcha version, but it is that where user need to enter random captcha string. And you saying about clean up jobs which i have been doing manually every week but that is not the solution
    – dev-m
    Aug 24 '17 at 18:10
  • @dev-m - sorry and don't take it personally for the duplicate flag. You didn't mention that you are aware of that other question, and really your question looked the same with that - it still does look the same - and although this is a broad topic - it tends to become too localized but without a certain point, so I am not sure of what type of answers can occur. I don't know if it's possible to retract the duplicate flag - but the community may decide if it's a duplicate or not. I also post an answer below - as it will be long for another comment here.
    – FFrewin
    Aug 24 '17 at 18:21

Note: This answer has been updated a few times.

As answer to your comments:

Hardly there will be so many real humans that will do nothing else than creating a fake account to your site every day, so most likely these are bots.

In addition, I don't think there is a way you can completely stop a real human from using something offered on your site.

Though, my answer on the other question that is proposed as a duplicate covers, what you need.

For example:

  • ProjectHoneyPot can help with bots and humans (with prior bad activity detected).
  • AdminTools Pro: you can block certain email domains, e.g. mail.ru
  • Bad Words Blacklists (admin tools pro).

But again a real human, could use another email the next time. Especially community-driven websites (e.g. social sites/blogs, forums etc) always need some sort of human moderation.

Take for example StackExchange network of sites. Although that huge network, it still depends on the community, the good will and the users and moderators to fight spam.

I really can't think of a system that could be 100% accurate to detect a real human that would register to post spam.

The final answer is a combination of actions you have to do, which mostly are described in my other answer.

Eventually someone could build certain functionality to detect and block certain behaviors - but again this usually can't work without the behavior occurs first.

How to stop (fake) users from registering on my website?


Do note that there are other similar security/anti-spam services like ProjectHoneyPot. For example: CloudFlare and Sucuri offer extra layers of protection and many security related features.

Also, do take into consideration @Lodder's comment below your question about the captcha version, the registration workflow (e.g. activation by email, or admin approval) and the script about auto-deleting non-activated users. I think Admin Tools Pro (inside the system plugin) provides this feature.

Another Update

Another tip is that you could block countries by IP, if your users are coming only from a certain country and the spam users come from others.

Again I don't know of what other kind of answers your question can trigger, as it remains kinda broad and general. Also you haven't mentioned if you have implemented any of the possible solutions that have been suggested already and what the result was.

  • Additionally you could use an extension that integrates Akismet. The official website says it is for Wordpress, but a lot of Joomla extensions use it to filter out spam.
    – TryHarder
    Aug 24 '17 at 23:13
  • Ffrewin I already mentioned that i tried to use some free extensions(like easycalccheck) but...i dont want to pay for pro version.also i tried to ban by IP. You mentioned these are bots bcoz many human cant do all these but i think different emails are being used not many humans. When i going to delete those users, i m not sure who is spammer coz they not always use mail.ru and yandex.com emails.
    – dev-m
    Aug 26 '17 at 19:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.