Stopping robot registrations

Question

Some months ago we started getting a bunch of robot spam users registering on the website. Both a CMS (Joomla 3.9.24) and Civi (5.33.2) user/contact are created with only firstname, lastname, and email. Here's what I've investigated:

1. I checked to make sure the reCaptchas were functioning and increased those settings.
2. I've looked at the Civi logs and tried logging page activity in the CMS (with extensions), but I'm not finding any clues as to what page these robots are registering on. It's clearly a Civi-related page, because a Civi contact is created.
3. I disabled the public mailing list sign-up profile temporarily and still got robot registrations.
4. I've changed the settings on public "stand alone" profiles to send me a notification email when someone uses them. Still getting registrations without any Civi notification.

What are some next steps to help me figure out where these are coming from and how to stop them? I know there is a Civi extension to up the game with reCaptcha, but if I'm not sure what page/profile to deploy it on, I'm not sure how that would help.

Answer 1

Since a Joomla user is created, there are one of a few scenarios you could be encountering:

Joomla's user registration isn't disabled

I don't know how to disable user registration in Joomla, and there are some scenarios where you can't. Your mitigations are:

• Turn off user registration (only admins can create users).
• Edit your web server configuration to return a 404 error on the User Registration.
• Check for Joomla-specific plugins to catch spam user registrations.

A Civi profile is configured to create a Joomla user

Profiles can create CMS users. Check your profile settings to see if this is applicable to you - either one by one at Administer » Customize Data and Screens » Profiles, or with this SQL: select id, title from civicrm_uf_group WHERE is_cms_user = 1;.

If you have any, you can try to isolate the particular profile by adding users to a different group per profile. Simple mitigations here are just ReCAPTCHA

Reading web server logs

Finally, if you know how to read web server logs, check the created_date on one of the spam submissions, and find the timestamp in your web server logs that corresponds. It will show you the URL accessed that led to the user being created.

Answer 2

One of the steps we did in Civi was to set our Available Countries. This does not allow user registrations unless they are from within one of the countries on the list. Most of the spammers are operating in specific countries, so if you are not needing the whole world to have access to your forms, then you can do this to block out a large % of these guys.

Admin>Localization>Languages,currency,locations then scroll down to Available Countries and add the one(s) that matter to the approved list

Joomla might have something similar as well that you can add there.