[Developer]

Forum Robot Spam Prevention Recommendations


As many of you will already know, the quantity of forum spam is on the rise. Tools to defeat image-based CAPTCHA systems are growing more sophisticated.

Development is ongoing into better anti-spam tools for vBulletin to assist with spam prevention and removal (both on an assisted and automatic basis) but these tools are not yet ready for release.

For the immediate future, we make the following recommendations. Note that each recommendation is prefixed with the minimum version of vBulletin required to make these changes.

(3.6+) Upload new images and fonts for the image verification system

To make the built-in image verification system more difficult to break, you can make it unique to your own site.

You will need to create ten 201 x 61 pixel JPEG images. The images should be named 'background1.jpg' through to 'background10.jpg'. These should then be uploaded to the images/regimage/background folder of your vBulletin installation, overwriting the existing contents.

You can also upload new fonts in TrueType format (.ttf) to the images/regimage/fonts directory of your vBulletin installation, making it more difficult for robots to recognise the text of your CAPTCHA images. TrueType fonts can be downloaded from a number of font library sites.

(3.7+) Use an alternative human verification system

If you have not already done so, you could take the necessary steps to switch to the reCAPTCHA system available in vBulletin 3.7. This system is extremely difficult for robots to work with, because the words presented are, by their nature, difficult for machines to read.

Alternatively, if you have sufficient time to do so, you could benefit from using the Question and Answer Verification system, also available in vBulletin 3.7. With enough questions and answers provided, this can be a very effective tool in preventing robot registrations.

Attachment 27818

(3.7+) Enable Akismet

The vBulletin Anti-Spam system powered by Akismet can be effective in identifying and deleting spam. vBulletin 3.7 owners can enable it by signing up for an Akismet key, then visiting the Spam Management section of the vBulletin Options in the Admin Control Panel.

Attachment 27819

(2.0+) Add a required custom user profile field

If your site is not being targeted directly, but is simply part of a pool of sites being attacked, it can be effective to add a custom user profile field that is required at registration time. However, if a human is behind the robot setup and analyses your registration form, this will not prevent robot registrations.