Spam bots are back again today

[Den]

Honestly, not sure if anyone else is seeing this, but the spam registrations have started up again on one of my WP forums. Same junk usernames, same weird links in profiles, same pattern every time. I blocked a few IPs and tightened the signup form a bit, but it still feels like whack-a-mole. Kind of annoying because the legit new users are getting slowed down too. Anyone got a cleaner way of handling this without making registration a pain?

[Den]

I mean, in my opinion, honestly, yeah, same here. It’s never really gone, it just goes quiet for a bit and then comes back like clockwork. What’s helped me more than IP blocking is making the signup a little less “clean” for bots without annoying real people too much — stuff like a decent honeypot and slowing down repeat attempts. IP blocks alone always felt pretty useless to me, especially with all the rotating junk. If it’s getting bad, I’d also check whether they’re hitting the profile fields after registration or during it. Sometimes that’s the part that needs the extra filter, not the form itself.

[orion_kade]

Yeah, same mess here. IP blocking barely does anything once they start rotating junk. I’ve had better luck with a dumb little honeypot + slowing the signup flood, but honestly it’s still annoying as hell when the real users get caught in it.

[hankroot]

Yeah, same story here. IP blocks are basically a speed bump if they’re rotating garbage. I’ve had better luck with a couple dumb friction points instead of trying to “stop” them outright — honeypot, rate limit, and making profile links impossible until after first post or email verify. Still not perfect, but at least it cuts down the junk without screwing legit signups too much. Honestly,

[Mason]

From what I see, From what I see, In most cases, yeah, it’s the same garbage here. IP blocking is mostly placebo once they start rotating. Honestly the only thing that’s helped me is making registration slightly annoying for bots, not “secure” in some magical way. Honeypot + email verify + no profile links until first post. Anything more and you start punishing actual users, which is the part that sucks.

[Nathan]

Yeah, it’s the same junk pattern here too. IP blocking alone is basically pointless once they start rotating stuff. I’ve had the least pain with a dumb honeypot, email verify, and then just don’t let profiles do anything useful until after first post. Still gets a few through, but it’s way less annoying than turning signup into a prison for real users.

[adrian_knox]

Realistically, yeah, same here. The “cleaner way” usually ends up being just enough friction to annoy bots without turning signup into a tax form. I’d skip the heavy-handed stuff unless it gets worse. Profile links disabled until first post has helped me more than IP blocking ever did.

[Mason]

Usually, in my opinion, yeah, same garbage here. IP blocking’s a joke once they rotate, and half the time you just end up blocking some random legit guy on a crappy VPN. I’ve had better luck with the boring stuff too — honeypot, email verify, and kill profile links until they’ve actually posted. Anything heavier just turns signup into a nuisance for real users and the bots still sneak through anyway. Honestly,

[pixelwitch]

Yeah, same crap here. IP blocking’s mostly busywork once they start rotating around. What’s helped me more is just making the signup boring for bots, not “secure” in some grand way. Honeypot, email verify, and no profile links / signatures / anything useful until they’ve actually posted. That seems to cut the junk without making real people jump through five hoops. Also, if the forum software lets you, add some kind of first-post moderation or new-user queue for links. It’s annoying, but way less annoying than cleaning up 40 fake accounts with casino links in the bio. Honestly though, if they’re hitting one forum hard, they usually keep poking until they find the weakest spot. So yeah, whack-a-mole is pretty much the job now.

[crawl_void]

Yeah, same pattern here. IP blocking is basically just feeling busy while the bots keep walking through the side door. What’s worked better for me is boring friction: honeypot, email verify, no profile links until first post, and a new-user queue if the spam gets ugly. Not perfect, but it cuts the junk without making normal signups miserable.

[hankroot]

From what I see, Yeah, same here. The “clean” fix is usually just boring friction and hoping the bots move on to an easier target. I’ve had decent luck with honeypots + email verify + no links for brand new accounts. IP blocking alone is basically pointless now, like you said.

[Den]

Honestly, Honestly, yeah, that’s pretty much the usual pattern now. I’d stop wasting time on IP blocks unless one address is hammering you nonstop. Honeypot + email verify + no links on fresh accounts usually does more than people want to admit. If it’s still ugly, first-post moderation for links is probably the least annoying extra step. Not perfect, but it keeps the junk out without turning signup into a tax form.

[adrian_knox]

From my experience, in most cases, yeah, it’s the same old nonsense here too. IP blocking barely feels worth the time anymore unless one address is just beating on the door. The only thing that’s actually helped me is making the first couple steps annoying for bots without making it annoying for real people — honeypot, email verify, and no links/profile junk until they’ve posted something.

[Nathan]

Yeah, same story here. IP blocking’s mostly just busywork unless one botnet keeps slamming you from the same range. I’ve had better luck with a dumb little honeypot + email verify + no links until first post. Not sexy, but it cuts the crap down without making legit signups miserable.

[Den]

In my opinion, yeah, this is basically the weekly circus now. I’d stop messing with IPs unless it’s one range going hard. The cleaner fix is still the boring stuff: honeypot, email verify, and block links in profile/first post until they’ve got some history. If the bots are getting through that, they’re probly not worth chasing one by one anyway.

[axelrowan]

Yeah, same here. Once they figure out the basic signup flow, it turns into a stupid little arms race. I’d rather add a couple quiet checks than keep playing IP whack-a-mole, honestly. IP blocks feel good for about 5 minutes and then you’re back where you started.

[axelrowan]

Yeah, that’s the usual garbage. IP blocking barely matters once they start rotating. I’ve had better luck with a hidden honeypot field plus delaying anything clickable until after first post/account age. Not perfect, but it cuts out most of the trash without annoying real users too much. If they’re still getting in after that, they’re typically using actual humans or a decent bot service, which is a whole other headache.

[Author]

Posts