- This topic has 9 replies, 5 voices, and was last updated 3 years, 7 months ago by
.
-
Posts
-
We have a simple membership plugin and the google captcha for the registration forms, problem is we getting spam on registration forms for the membership levels . All plugins are up to date and WordPress is also latest, why are we getting so much registration spam?
The user registration maybe coming form another source. For example, the default WordPress’s user registration system or you may have another plugin on this site that allows user registration.
Please enable the debug logging feature in our plugin which will show if the registrations are coming from our plugin or not and if they are completing captcha or not. That will be a good starting point to investigate this.
https://simple-membership-plugin.com/enable-debug-logging/Also note that you can still have humans who manually submit a registration form for spam purposes. The captcha can’t block humans who is coming to your registration page and submitting the form correctly. The captcha blocks a spam bot from submitting it.
WordPress Registration is disabled under settings -> General -> Anyone can register is not enabled.
Wordfence l have blocked the xmlrpc.php file not to allow remote form posting via APIs and also blocked form not having POST in the headers.
I have enabled debugging on my website [primequest.co.za]
Hello,
Since around the beginning of 2022, I have also had the phenomenon that “spam” registrations keep coming through the membership registration form.
The google catpcha protection is up to date and registering without ticking the captcha does not work. Means captcha does its job. There are no other registration options (no comment function or similar)Are there really such “geniuses” who enter this manually?
Did you find out anything about the phenomenon with the debug log?
Thank you for your brief update on this.
Had the same problem. Also with deactivated wp user registration.
the only workaround I found was cleantalk with country blocking. the site is just German and the spam came from China, Russia, Belarus mainly – this helped a lot … unfortunate I have another site where I’m planning to use simple membership -at the moment it is on Patreon and I have paying subscribers from these countries ….It would really help to have an flow like
fill the register form – pay with PayPal/stripe and after receiving the payment the “real account” will be generated.btw. an alternative more elaborate hack if you have a vps / root access to the server would be fail2ban, a paid maxmind GeoIP2 subscription for a more uptodate database and then an countryblock build with this. not really trivial and more expensive.
Using recaptcha option should solve this. I think you are not using recaptcha due to GDPR related reasons. Have you checked out the recaptcha enterprise option? Their description says that it handles GDPR also.
We have an integration with recaptcha enterprise (if you wanted to try that option):
https://simple-membership-plugin.com/simple-membership-google-recaptcha-enterprise-option/If your site is well ranked in google with a topic spammers love, reCAPTCHA makes not much difference.
There are services like 2captcha.com, they pay real people to solve captchas and even providing an API to their spamming customers. I would be extremely interested in a better solution than reCAPTCHA and the country blocking I’m doing right now.@herrmartin — You can always charge a minimal amount, like $1 for registration. That will cover the cost of processing the PayPal transaction.
- You must be logged in to reply to this topic.