I've been running a Joomla-based website for over 15 years. It's focus is ocean paddling (on things called surfskis) and the busiest part of the site (and in fact the only reason I've kept it going) is the Kunena-based forum.

We keep the site up to date, having had a run-in a few years ago with hackers who inserted a shell script via an add-in module... the shell was only noticed over a month after it had been installed, so we had no back-ups to go back to, and I fought them over a couple of weeks before I found all the multiple, hidden shell scripts that they'd inserted. Since then we've been religious about only using reputable or paid add-in modules and keeping everything up to date and we've avoided any more of that kind of trouble.

But I can't stop fake user registrations. We use captcha and email confirmation, but there are clearly bots capable of getting around both and I see attempts almost every day of people trying to post to the forum. The final defense is to moderate the first two posts by any new user on our Kunena-based forum - and this works, in spite of the spammers sometimes going to some lengths to try to fool me. Fortunately our sport is fairly niche and my bullshit antennae are highly attuned and I've always been able to detect and block and ban them. I know there are humans behind this - because on occasion I've had email conversations with them.

I reduced the problem massively by blocking IP addresses from India and Pakistan - the volumes are growing again as places like Ukraine (sadly) and Hong Kong get more involved in this - and I suspect that some of the spammers are using VPNs.

It's a giant waste of time. They always have crappy email addresses like [email protected] or [email protected], so there must be an relatively easy way for an AI-based filter to prevent them from registering in the first place.

I've searched the interwebs, but nearly all the advice is the tired old "use captcha", "use email confirmation", "block them on the firewall" approaches - and I've not found any more sophisticated solutions.

Has anyone a better approach to this issue? Ideally a module that recognizes fake email addresses and redirects the user - perhaps to a never ending registration form that asks more and more absurd questions to waste as much of their time as possible.

1 Answer 1


You don't say how many genuine new registrations you get in a week and to a degree that is important in this approach to combat the fake users. I inherited a large Forum fighting 100's of fake registrations daily somewhat because of the popularity of the Forum it appears in the first few pages of a large variety of searches making it a big target.

I migrated it to Kunena and we replaced self registration with a link to register by sending an email to a mailbox that is monitored by the moderators. The emails ask the 'person' to provide three bits of information, Name, Username and what is their interest in the subject matter of the Forum. That last bit of information makes it easy to identify someone who has no idea what they are trying to sign up too.

We use captchas on the first two posts but it is rare for anyone to get past the email. Sometimes you will see an email with Gmail address and no body in the email and they tend to be bots. Occasionally it is someone just being lazy or elderly and will try again with details provided within a few days, and if they are being lazy then we don't make any effort to register them.

It is not a sophisticated AI type of solution but for the genuine registrations we get weekly it only takes a few minutes to create a user account, compared to hours previously wasted every week trying to clean up or prevent the fake ones that the mods were doing. You might spend more time creating accounts and interacting with the people you want on your forum, however the people you don't want are no more than a click away from going into the Trash.

There is also some side benefits of the emails in that you get to read some interesting insights into the people joining, some of which we share in an 'Introducing [insert name here]' type of post and that kicks off their involvement. We seem to get a better class of user as they have to make an effort to join up so they tend to be more invested in the subject matter rather than people just clicking a link and joining up by habit or because they can.

On another non-Joomla Forum I have 'Stop Forum Spammer' connected add-on and it works well enough for the self registrations but it still requires effort to review and clean up the fake registrations. Kunena has similar API connections for such services.

  • That sounds like a simple plan. We have few new sign-ups and tens per day of fake ones. Just to be clear, you're saying that you have no self-registration at all? To join your forum, send an email with the three bits of info. What about setting the password? Do you set the account to require a password reset on first login? Jul 4, 2022 at 13:25
  • That is correct, no self registration, we manually create the new Users account. As part of that process we do set the Password Reset Required and Assign the User Group(s), members vs non-members, and they receive the automated email generated and sent by the account creation process. We also provide a reply to their original application email with a 'Welcome and if you don't get a separate email with your login details please let us know.' As not all Joomla create emails will get through spam filters so it helps to catch those.
    – Irata
    Jul 4, 2022 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.