the problem is not even in spam, but in the fact that thousands of accounts can register automatically, or people can try brute login page.
Normally, the login, registration and password recovery pages should be captcha protected.
and the solution that you suggested is already treating the symptoms and not the cause.
I have a question for what reason there is no such standard thing as a captcha or just a “question - answer” by default.
I thought the presence of captcha was not even discussed and logical on the modern Internet.
allow only social logins, create white lists of email providers, I think is not a solution.
Why invent crutches in the form of incomprehensible services that no one needs, when captcha was invented for this and everything else is already as additional options if 1 line of defense is broken.
i was find one solution there GitHub - klaudgrave/discourse-google-recaptcha: Adding Google Recaptcha to sign up form · GitHub
but it seems that it has not been working for a long time and is not supported due to forum updates.
but I can’t find any documentation on the plugins what they need to work properly. To fix the found solution or write my own.
and how i can allow users only use long passwords line 12 min and all character set.
Andalso add to register page an inscription above the password for users so that they use a unique password and not the same on all sites.