Every month there are hundreds of malicious users (most of the registering emails are from some Russian domain) registering my site. This is mixed with scores of authentic users.
I have already turned on reCaptcha.
What is the proper way to combat these inauthentic user registrations without damaging the user experience for authentic users and without a high cost to my time/diligence?
If you only have a low number of real users expected to join you could disable automatic registration and put an approval by admin step in there. On a popular Joomla based forum website we only have one or two a week join so they have to email their details and answer a couple of subject matter questions before we create a user account. It is a lot less time consuming and effort to allocate one or two users manually than clean up the 100's of fake users we were dealing with each day beforehand.
For sites with a lot of new registrations of users and fakes you could use this free extenstion from Joomlshack, https://www.joomlashack.com/docs/ospam-a-not/how-ospam-a-not-works/, which times how fast someone fills in a form with the idea being a bot is going to be quicker than a human.
It installs as a plugin and I have checked that it adds its hidden fields to the bottom of the standard 'New Registration' form so it should block bots creating new users but you might need to tweak the time value in the plugin to see what works best with your site.
If you have other forms on your site with only a couple of fields you might find a time set in the plugin that is too long might block a human who might be just checking some boxes on a form.
It is not a silver bullet that will stop all the fakes, but could work as a another level of defence for your site.
