Very good list! I´m planning to start a phpbb forum and was wondering what mods you would need to have a fairly SPAM-proof forum straight away.
A list of those mods would be nice. I´m especially intersted in how you can prevent memberlist spamming (don´t quite get you post on it 
)
very helpful tips indeed! I will be applying these tips in my own forum!.. If ever I get the time for this 
They [the kiddies] have evolved quiet a lot over the last six months I’ve covered all 10 but still they are persistent (but obviously they fail to post or leave signatures).
They now seem to be getting rather good at working around antispam mods though it’s still a good list.
I have a cron job that runs twice a day to delete any users that register, have zero posts, and a link in their profile. That seems to work fairly well.
FYI, one of the easiest ways to stop spam is using javascript as most bots don’t use javascript. You can embed captchas and post forms in obfuscated javascript which makes it hard, if not impossible, for their bots to even locate your forms or captchas.
I’d be very interested in seeing your code for this!
I have a cron job that runs twice a day to delete any users that register, have zero posts, and a link in their profile. That seems to work fairly well.
and I´d be very interested to know how that cron works 
It’s not that complicated, you basically move your code from raw HTML to javascript document.write(). To obfuscate certain elements like the form tag, or input, make them variables chopping up in pieces like “zyz=‘<’; qrq=‘or’; etc.” and then your javascript writes look like: zyz + ‘f’ + qrq +‘m>’ which spits out “<form>” but nothing a simple pattern match will locate.
Of course the next wave of bots (some already do) will all run javascript, but such simple tricks thwart them today.
I actually require javascript to run my captcha which stops them cold as there’s no blow thru for that other than running or interpreting the javascript code in the page.
Unfortunately a few humans are forced to turn on javascript, but they’ll get over it if they really want in bad enough.
I just started testing something new last week which works wonderfully so far, which is automatic moderation based on the LACK of content in the post.
The concept is just the reverse of filtering for bad words and rejecting posts containing words like viagra, cialis, etc.
What I’m doing is looking for words that tend to be in 99% of my submissions that aren’t spam, and anything lacking those words or the keywords in the original topic of the thread are automatically moderated.
For instance, if you have a site about plumbing you would expect people to post things about pipe, fittings, washer, sink, faucet, toilet, etc. or anything with the root word “plumb” in it, or keywords from the original topic, quotes, etc. Of course short posts could get caught, but I have a few rules that make decisions about these things.
Any posts without those keywords made by new members, especially posts with URLs from newbies, goes into automatic moderation.
So far I’ve snared about 5 hand spams a day with this trick but it’s only been in operation over a week.
Like I said, this auto-moderate rule only applies to newbies, people that have been around bypass this reverse filter.
Hopefully, if this continues to work and they don’t catch on to what I’m doing it will allow me to continue running wide open without putting all newbies on moderate.
Has anyone had much luck in banning IP addresses, ranges of IPs or even IP space for an entire country?
It used to be that most of the worst spammers were coming from countries in the Asia region, but lately I’ve been seeing IPs from the US that appear to be from Internet access providers accounts as well as hosting datacenters. I’m taking it that much of that spam is from compromised computers/servers.
I do most of those, if you use vBulletin you cannot do all of those limitations unless you’re using the most recent version since some of them at new to vb 3.6. So upgrade.
Another thing you can do is remove the public display of your forum version from the footer. Keep the copyright statement, but change it from “vBulletin Version 3.0.3” to just “vBulletin”
The reason of course is that often a vulnerability for a specific version is discovered and then as part of their spamming the spammers search for this specific version.
Chris, would you recommend removing the forum version for SMF as well (just wanted to make sure I was reading it right–if I did, then the answer would be a resounding yes)?
I think doing it for every forum software is a good idea.
I too have just been helping a friend to combat spam on his phpbb forums. I added 2 new mods to the forums. Firstly, this one. This enables the admin to remove all the things the spammers love when “registering” - website url, icq, msn, yahoo, signature etc. You can then choose how many posts a user must make before they can edit their profile and update the fields missing when they registered. If a spambot attempts to register and includes any of those fields, the mod detects this and stop the registration. Then on the recommendation of the author of that mod, I added [url=http://www.phpbb.com/phpBB/viewtopic.php?t=399863]User Shield which does as the name may suggest - it shields your users away from possible spammers. Basically, what this mod does is hides all the new registrations that haven’t clicked their verification email. The admin/mods can click a link on the index and remove them all in one go.
Finally, there was a forum that was enabled to Guest postings. This was setup for users who experienced any problems registering/logging in. Of course, each day this would be full of spam posts. So I stopped Guest posting and just put a thread in there along the lines of: “If you are experiencing probs blah blah blah, please email this address:” and then made an image that shows the email address - I figured better this way than have a mailto and let them pick that up as well!
It’s certainly drastically reduced spam on the site and my friend is more than happy.
Delete users where post = 0 and profilelink = Yes
I’m sure it wouldn’t take long to code this in your forum language
Removing the forum version for wide open pieces of bug-ridden filth like phpBB or infopop (formerly ubb) is a good idea, because just knowing which version can let you hack it straight off.
I wouldn’t worry about it with SMF, since it’s entire structure is more secure; case in point, I have YET to hear about a SMF based site being hacked where it was SMF’s fault… Honestly, because all the sub-php files verify a define before running, do not output anything instead requiring all output to come from function calls, routes ALL requests through index.php (even the admin functions) and uses a upload manager that prevents uploads from having execute permissions… You’d be hard pressed to find a reason to worry about it… The only concievable route in being a flaw in php itself or someone having shell/FTP access - at which point forum security is the LEAST of your problems…
Unlike phpBB, which with versions > a year old I can still ban the admins on remote by simply calling the appropriate sub-php file from an upload… Not to say most other forum softwares are a total train wreck when it comes to security, with holes big enough to cruise the USS IOWA through, but… well, there it is.
Thanks for the tips!
I get forum spam all the time
Wouldn’t the easiest step to prevent link spam in member lists be to simply remove the possibility to add a URL (and other unrelated information in terms of sign-up) through the registration form?
I like phpBB myself, though code clean-up, frequent back-ups and updates are musts.
This trick doesn’t stop the spam but removes any possible PR value from the profile page.
Modify your robots.txt and put a link condom on the profile page:
User-agent: *
Disallow: /profile.php
Putting a link condom on that page keeps the SE’s out, so the spamming of the members page has ZERO VALUE, yet members can still see each others links. Next, I would doubly make sure and stick NOFOLLOW on all the links in profile.php, and then it’s safe to run that pile of junk without giving member profiles, especially spamming members, any PR leakage.
Although we do like to say we are one of the most secure forums out there, we have had a few small but serious cross-site scripting holes in the past. But we release updates as soon as we can, and with the package manager installing these fixes in a few clicks there really isn’t much excuse not be up to date. But there is always the possibility that you could be attacked before a security hole is reported.
I have only had luck in IP banning for a few spammers (mostly kids trying to advertise their personal “look at me” web sites). Most spammers I have in my forums only post once or twice from the same IP 
Life would be much easier if spammers actually never changed IP…
/Andreas
I always forget about conditionals for the members page. Thanks for the useful list
