[Max Taxable]

Originally Posted by Digital Jedi

I do like how you have to play a video to see the verification string) along with requiring the user to enter in a YouTube URL. (I provide a few right there for them to right click and paste)

I use this cut/paste problem with the standard Q&A. The answer is identical to the question, which is a long, convoluted instruction to copy and paste the question into the answer box. Nobody's going to take the time to type it, and there are subtle built-in typing errors that probably wouldn't be noticed if they did. Bots cannot copy/paste, human spammers usually skip out and find a easier target.

I do like this Is Bot thing now that I've looked at it more closely, and may add that in as just another layer of defense and a way to see if I can get some reporting on if my registration protection is working.

I get about 80 spambot signup attempts daily, none ever succeed. Very rarely, the occasional human spammer does get through but finds the account created so limiting that it's essentially worthless, since new users cannot even send visitor messages, PMs except to Admins, cannot post images or links in posts, and cannot even use signatures or have access to the "home page" field on the profile. Most just hang it up and leave without even posting.

Many layers of spam protection is best, as you say. But I have found the IsBot mod to be by far the best bot catcher and reporter. I get their email address, IP address, what username they tried to use and I send all of the information to Project Honey Pot, and the IsBot works even if they don't fill out the Q&A field. There's also instructions in the Mod thread, on how to make it automatically ban these IPs and email addresses, for those so inclined. The other nice thing about IsBot, it doesn't give itself away with any kind of "gotcha" message, it just uses the default vBulletin "The Administrator has disabled registration" message. So the botnet administrators don't get the clue what is causing the problems getting their bots registered.

Currently I am also experimenting with hidden fields in the register.php script. These are fields the bots can see and will attempt to fill out, triggering the IsBot script regardless of time, if they do so. Humans won't see these hidden fields and therefore could never attempt to enter any data in them.

As you can see, I hate spam.