Some months ago we started getting a bunch of robot spam users registering on the website. Both a CMS (Joomla 3.9.24) and Civi (5.33.2) user/contact are created with only firstname, lastname, and email. Here's what I've investigated:

  1. I checked to make sure the reCaptchas were functioning and increased those settings.
  2. I've looked at the Civi logs and tried logging page activity in the CMS (with extensions), but I'm not finding any clues as to what page these robots are registering on. It's clearly a Civi-related page, because a Civi contact is created.
  3. I disabled the public mailing list sign-up profile temporarily and still got robot registrations.
  4. I've changed the settings on public "stand alone" profiles to send me a notification email when someone uses them. Still getting registrations without any Civi notification.

What are some next steps to help me figure out where these are coming from and how to stop them? I know there is a Civi extension to up the game with reCaptcha, but if I'm not sure what page/profile to deploy it on, I'm not sure how that would help. enter image description here

  • On the contact summary tab, the fourth one down is Source. That will tell you where the contact registered. Then you can focus on that form and implement reCaptcha etc as needed
    – Iowa Boy
    Commented Feb 12, 2021 at 19:07
  • Actually, there is nothing in the Source field. That would be helpful, though. Let me add a screenshot. Commented Feb 12, 2021 at 19:21
  • 1
    in one case i went through the db adding a unique email for each profile so i was cc'ed on submissions and could work out which were being used. just a thought. eg pete+1@mydomain, pete+2@mydomain etc where '1' and '2' were the profile ID
    – petednz - fuzion
    Commented Feb 12, 2021 at 19:24
  • other place could be (i don't know Joomla) equivalent of drupal /user/register, in case any of your profiles are set up for 'user creation'
    – petednz - fuzion
    Commented Feb 12, 2021 at 19:25
  • oh of course my first comment should only relate to profiles set for 'create cms user' but with tools like civirules and cmsuser extension it is possible to trigger a user creation after a profile submission so it these would obscure my first suggestion.
    – petednz - fuzion
    Commented Feb 12, 2021 at 19:26

2 Answers 2


Since a Joomla user is created, there are one of a few scenarios you could be encountering:

Joomla's user registration isn't disabled

I don't know how to disable user registration in Joomla, and there are some scenarios where you can't. Your mitigations are:

  • Turn off user registration (only admins can create users).
  • Edit your web server configuration to return a 404 error on the User Registration.
  • Check for Joomla-specific plugins to catch spam user registrations.

A Civi profile is configured to create a Joomla user

Profiles can create CMS users. Check your profile settings to see if this is applicable to you - either one by one at Administer » Customize Data and Screens » Profiles, or with this SQL: select id, title from civicrm_uf_group WHERE is_cms_user = 1;.

If you have any, you can try to isolate the particular profile by adding users to a different group per profile. Simple mitigations here are just ReCAPTCHA

Reading web server logs

Finally, if you know how to read web server logs, check the created_date on one of the spam submissions, and find the timestamp in your web server logs that corresponds. It will show you the URL accessed that led to the user being created.


One of the steps we did in Civi was to set our Available Countries. This does not allow user registrations unless they are from within one of the countries on the list. Most of the spammers are operating in specific countries, so if you are not needing the whole world to have access to your forms, then you can do this to block out a large % of these guys.

Admin>Localization>Languages,currency,locations then scroll down to Available Countries and add the one(s) that matter to the approved list

Joomla might have something similar as well that you can add there.

  • Our "Available Countries" has always been set to only the US and Nicaragua. That only applies to address fields, not to restrictions on IP locations. I've restricted some IPs, but the robots are coming from all over the place including countries we don't want to give blanket restrictions to. Commented Feb 13, 2021 at 16:36
  • Opps, I guess that would just be for address fields
    – Iowa Boy
    Commented Feb 13, 2021 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.