Order of the Bath

For some time I have been having problems with registered users. Not the dozen or so users that I know about who either contribute to the site or are left over from the days when I insisted on registration before commenting. No, these are ones where “people” have found the registration page, created a profile but I have never heard from them since. I have been looking for a way to clear them out, which is not easy because I have no way to tell if they have actually commented using that profile and if I delete those, then the comments disappear with them. I have been looking around for a plugin to help and in the mean time I have been deleting ones with email addresses in Russia, Bulgaria and Poland—it is not xenophobia, just that I know that there is a 99% chance that they are spammers.

One possible plugin that I have tried is loginlogger. This keeps a track of when people have logged in. I was hoping it did a bit more but even that has been fascinating. Apart from my own connection, which I know about, I had well over 100 failed logins over a 2 hour period last night, and the usernames were quite repetitive; brutal2008, Reiki, kazikr, broker1980, watroba50, smiglidigli, bombastik2008, etc. occur quite often. These names don’t appear in my roster (but they may have once and I have deleted them, I don’t keep track) but doing a Google search on them reveals a common pattern; most hits are either on SEO sites or are Polish or Russian sites or in those languages.

So my policy seems to be justified—that is where the spammers are. To avoid the problem in the future I could have disabled registration altogether. It isn’t used a lot, but I like to give regular commenters the option of having their profile stored if they want to. So what I have done is install the Sabre plugin. This is a very flexible registration control system with options for Capcha, arithmetic tests, email confirmation and other validation tecniques. I am hoping that with minimal effort I can foil the majority of automatic bot registrations.

This entry was posted on 20 May 2008 at 11:30 by Rick and is filed under Security, Technical, WordPress. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.