I built a discourse today but get many new user registration spam. [image] [image] Many are from the same IP and they don’t pass the email verification. Due to the limited email I can send a day (a free plan), how to prevent this kind of spam? For example, add a CAPTCHA when signing up? Than…

Even though they can’t post, they do some random things such search queries, [Screenshot 2025-03-17 at 4.34.59 PM] or seemingly trying to hack the auth system: Job exception: Net::SMTPAuthenticationError (google_oauth2) Authentication failure! invalid_credentials: OAuth2::Error, invalid_grant: B…

Seems these signups are coming from the same IP address ? Something would probably need to be done there. Block an IP address after x signups during a certain time frame ? Or forbid another signup from an identical IP address for some time ?

@Mevo But when I block and delete these IP, the spamer begin to use proxy to change his IP constantly and sign up new users.

Wow, seems they really want to create some accounts on your forum :wink: Are they using them ? Or keeping them to spam later ? What’s their goal here ? (just curious) Then a CAPTCHA indeed seems what you need (I’m sorry, I cannot help you on that subject)

CAPTCHA or IP rate limited may solve them?

I have to abandon discourse finally.

Sorry, we don’t see this severe of a problem with signups / registrations across any of our hosting, or any self-installed sites I know of? Is there something wrong with your configuration?

Not configuration issue. It’s a kind of spam by someone I think. Discourse needn’t CAPTCHA before sending the verification email in sign up process. So everyone can generate many fake email addresses to auto signup with program and disrupt the community.

[image] The spam never stop until I disable public signup.

Right but these accounts are never activated (no user clicks the link in the email sent to verify the email address), and Discourse deletes unactivated accounts after 7 days by default. So ultimately this does nothing for the “spammer”.

Right. But they will fill up the email server. For example, I have a limited email server plan and I can only send 200 mails per day. The spam made me exceed the limited yesterday, so I have to pay a lot money to the email server.

كيفية منع رسائل البريد العشوائي في التسجيل

الدعم

jack-sparrow 30 أكتوبر 2020، 7:37ص 24

هل يُعدّ إضافة التسجيل/تسجيل الدخول الجديدة حلاً لمنع التلاعب؟

الموضوع		الردود	مرات العرض
A recaptcha plugin? Support spam , auth-plugins	2	166	20 مارس 2025
Just had about 38 bot accounts and posts sign up and spam in the space of 30 mins Community Building spam	12	436	12 أكتوبر 2025
Tips for Preventing Spam Site Management explanation , moderation , spam	14	5049	1 ديسمبر 2025
Filtering spam/troll accounts Support spam	10	226	15 مايو 2025
Blocking spammer.<random>.domain registration attempts Support	12	203	8 نوفمبر 2025

كيفية منع رسائل البريد العشوائي في التسجيل

الموضوعات ذات الصلة