Bots still register on website even though CAPTCHA is activated
To specifically block bogus registrations, I've found the project MotherMayI to be a great help.


  Mother May I provides a simple to use extra hurdle to reduce the bother of spamming account requests. It's primarily useful to sites with a limited target audience (at least for authenticated accounts) where valid users have some side information about the group. The site administrator can define a site-specific "secret word." Anyone requesting an account must enter the secret word before even a temporary account is created.


As the quoted text says, it is best suited for sites with a limited target audience.  However, the module lets you give a "hint" that is supposed to make it simple for humans to find the secret word, and I've found that even ridiculous easy task where where the hint is "Please type in cartoon character Fred Flint's last name" (and the secret is "Flint") works great.

MotherMayI allow you to have a long "hint" text and use a RegExp for the answer, but only allow one "secret" word.

There is an alternative in the CAPTCHA family called Captcha Riddler that works similarly.   It allow multiple riddles to be defined to separate humans from robots, but only allow short texts for riddles and have no RegExp function.

Since you define the "secret" word (MotherMayI), or "riddle" (Captcha Riddler), these methods are more immune to the "training" feature of Xrumer and other pests.  This means the 'bot need to be trained specifically for your site.  Unless your site is really huge, you'll be able to fly under the radar for a long time. And it is trivial to replace the secret word or riddle if the robot is trained to recognize your site.

Are You A Human playthru (also mentioned by Mołot) is in the same genre as the previous two, but IMHO slightly more cumbersome for humans to "solve".