Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a installation of Multisite that has a history of serious signup spam problems.

When we ran WPMU 2.9.2 we tried this .htaccess method, this math plugin, and CAPTCHAs. After little success with those options we added some common email domains to Limited Email Registrations. We noticed that even after adding this measure we were still getting signups from domains we had banned. This made me think that there was a hole somewhere in the signup script (explaining our limited success with other measures). Are there any known issues with Limited Email Registrations or any other holes in the signup process with older/current versions of WP Multisite?

We have since updated to 3.3.1 and continue to experience significant spam signups. With the .htaccess method, math plugin, bad behavior, and of course e-mail activation, we still get 20-50 spam signups a day. I have a hard time believing that their isn't a hole somewhere.

share|improve this question
add comment

2 Answers

There is a known problem as described in this ticket and this blog post

The problem was identified in 2.9.2 but looks to also have been identified in 3.0.

From the sounds of it, the wordpress team won't fix this bug, because they feel spam is inevitable, and that it is the responsibility of spam protection plugin authors to account for this bug.

share|improve this answer
add comment

Have you tried ZBBlock yet?

http://www.spambotsecurity.com/zbblock.php

It would help prevent known spammers and known spamming attempts. Just remember to enable the Stop Spam Forum option.

Also have you tried this plugin with optional .htaccess method? http://wordpress.org/extend/plugins/cookies-for-comments/

You could also try requiring a PHP session cookie. Once you have the cookie set: http://www.php.net/manual/en/session.configuration.php#ini.session.use-only-cookies you could do something like the following in .htaccess:

RewriteCond %{HTTP_COOKIE} !^PHPSESSID=\w+ [OR]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?example\. [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^wp-(login|register|signup)\.php http://example.com [R=301,L,NS] 

Where example.com is your domain

share|improve this answer
    
We use cookies-for-comments for comments and it seems to be very effective. I hadn't noticed the option to add it for signups, so I'll try this. –  SomewhereThere Jun 29 '12 at 21:24
    
You could also try requiring a PHP session cookie. Once you have the cookies set: <br/> php.net/manual/en/… you could do something like the following in .htaccess: <br/> 'RewriteCond %{HTTP_COOKIE} !^PHPSESSID=\w+ [OR] RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?example\. [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^$ RewriteRule ^wp-(login|register|signup)\.php example.com [R=301,L,NS]' <br/> Where example.com is your domain –  MickeyRoush Jun 29 '12 at 23:08
    
See above edits to my original answer. –  MickeyRoush Jun 29 '12 at 23:16
    
After a few days of experimenting, adding RewriteCond %{HTTP_COOKIE} !^.*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.*$` `RewriteRule ^wp-signup.php - [F,L] to .htaccess was very effective. The problem is that with a subdomain multisite install, I cannot link users to wp-signup.php from a network site. While I appreciate the recommendations, the main question is "are there holes in wordpress multisite that allow bots to bypass spam prevention methods?" because I've observed strange behavior and am surprised that it takes 5 different methods to combat signup spam. –  SomewhereThere Jul 3 '12 at 23:31
    
@ SomewhereThere. I don't have any experience with Multi-Site, because there are so many unknowns for me and that many plugins won't work. But it seems possible that if you require a cookie and/or a referer, in .htaccess that would stop a lot of spammers or sploggers. I do remember reading somewhere that some time ago some Black Hat SEO person figured out a way to spam BuddyPress and Multi-Site. I just don't remember finding out how they did it. –  MickeyRoush Jul 4 '12 at 9:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.