Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

How to block Bots from autmatic registering

  • Participant
    Level: Master
    Posts: 497
    Daniel on January 19, 2021 at 12:14 pm #35623

    Hi,

    Due to bots creating automatic profiles I wanted to ask you if you could provide any infos about how bots are able to automate BP registrations? Is there a php file that they can access for running a java script query (same as for wp-login.php) or is it only possible to register through the standard BP register page?

    Thanks for your information.

    Regards,
    Daniel

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 19, 2021 at 11:05 pm #35659

    Hi Daniel
    Most of the bots use curl to access and submit the data to the registration form(your BuddyPress signup form) handler.

    The most effective way against automated bots are to test for javascript enabled state. It will block most of the bots. It does not stop the human spam though.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 497
    Daniel on January 20, 2021 at 8:44 am #35666

    Hi Brajesh,

    Thanks for the helpful input, I will check to do the necessary for blocking javascript requests.

    Thanks again.

    Regards
    Daniel

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 20, 2021 at 9:01 pm #35686

    Hi Daniel,
    You should block non javascript requests(requests from devices which do not support javascript).

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 497
    Daniel on January 21, 2021 at 1:13 pm #35697

    Hi Brajesh,

    OK thanks for the info. I actually have set a Cloudflare page rule and set to “under attack” mode for register page but these bots still find a way to undergo the protection.

    Will need to think about how I’m gonna do that.

    Thanks anyways.

    Regards
    Daniel

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on January 21, 2021 at 7:15 pm #35702

    Hi Daniel,
    All the best with stopping spam 🙂

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 497
    Daniel on January 26, 2021 at 1:28 pm #35793

    Hi,

    I have found some code to block CURL from creating automated registrations.

    if(stripos($_SERVER['HTTP_USER_AGENT'],'curl') !== false) {
    http_response_code(403); //FORBIDDEN
    exit;
}

    but it is not mentioned where I should place the code. Do you think if I place it in bp-custom.php it will be working?

    Thanks for your help.

    Regards
    Daniel

The topic ‘How to block Bots from autmatic registering’ is closed to new replies.

This topic is: not resolved