Drupal 7 Site: Targeted for spam Okay, I'm not sure if this question should be here, but it's more of a general question. So I'm hoping if anyone can relate to this, perhaps you can suggest something to get around this. So I worked on this particular site. Using drupal 7. It's a kind of article site and content is about anything out there, nothing specific, it's more on the fun side. Since we've allowed sign ups, we've been getting a lot of sign ups of users, but most of them seem to be a group of spammers or trolls. No matter how much I try to contain it, they just keep coming and sign up. I have enabled captcha to prevent bot signups, as well as on the commenting sections so we don't get tons of spam more than we can handle. I also enabled sign up approval so I could see who signed up, and for sure everyone of them have tell tale signs of spammers. Imagine usernames that don't make sense. Randomly generated or whatever. Should we ban the ips, or the email domain names? No room for just one question, it may be all general but it concerns the whole site in itself. Not sure what the work around is, but I sure appreciate any suggestions from those who got around this. Thanks. Cheers.
One module you can make use of in this situation is the honeypot module. The Honeypot method basically inserts a hidden form field to Drupal (or other). End users don't see the field, so they don't fill it out. But spam bots (usually using prewritten scripts) do see the field, and always fill it. The Honeypot module detects this and blocks the form submission if there's something in the field.

EXTRA OPTIONS YOU COULD ADD

Another Simple thing you can do according to this site is hooking into the Drupal user registration process and using a php snippet like this:

flood_register_event('reg');
if (!flood_is_allowed('reg', 4)) {
header ('HTTP/1.1 403 Forbidden');
die();
}


Using the flood_register_event() method to register a possible flood event. The method records every registration when used in this context. Next, using the flood_is_allowed() check if the current user has triggered the flood register event more than 4 or XX times. If the user has tried to access the form 4 times they get another lovely 403 and all output is killed. You could use this logic either when rendering the Drupal registration page or upon every new submission.