[thisgeek]

Fixed! People can now successfully activate their accounts from the link mailed to them.

The corrected code is below. Essentially it's fixed by adding the following rewrite condition to the TOP of the ruleset:

RewriteCond %{QUERY_STRING} !^a=act&u=(.*) [NC]

Originally Posted by thisgeek

Just replace "domain\.tld" with your own domain.

EDIT: I've fixed the rewrite code so activations now work.

RewriteEngine On
RewriteCond %{QUERY_STRING} !^a=act&u=(.*) [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.tld/ [NC]
RewriteRule register.php$ - [F]

Or, if you're inclined, create a sticky locked thread where you rant on a bit at bots, and redirect them to that instead, or use the topic to explain to people that they need to use the register link on the main site instead of accessing /register.php directly.

RewriteEngine On
RewriteCond %{QUERY_STRING} !^a=act&u=(.*) [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.tld/ [NC]
RewriteRule register.php$ http://www.domain.tld/showthread.php?t=12345 [R,L]

For what it's worth, this seems to have reduced quite a lot of bot registrations.