Miscellaneous Hacks - Stop the Registration Bots

Control your vBulletin forum registration process and stop the registration bots.

This mod will check the the time it takes for a vBulletin registration form to be submitted. If the form is submitted faster then humanly possible, the registration will be denied and the admin contact will be emailed about the event. The time is settable

We will start the registration on the forum rules page in two ways. First we will add a custom hidden field with a hash. Second we will insert a randomly named hidden field with a random value. This should make it a bit difficult to program a bot since the field names on all sites will be different as well as the values.

We will use a second set of random hidden fields on the form page as well to add to the confusion.

Time stamps to check the time spent on registration submission are stored in a DB table and private.

A registration will have to come through the Rules page and the form. Every Site will be different.

Installation is very easy.

There are two templates to edit.
One database table is added.
Three hooks are utilized.
Includes uninstall code.
Adds to vBulletin options.
Set time frame option.
Includes Phrases.
Sends Mail to Admin.
No files to upload.
XML product install.
Instructions attached in zip.

Demo usage and view source at http://www.riderinfo.com/

Compatibility
This hack is known to work on vBulletin 3.6.11 PL1 and will likely work back a few versions in the 3.6.x vBulletin series. Of course it works on 3.7.x as posted too.

HISTORY
1.2.2
added admin email on/off setting
moved hook code to files to reduce overhead.
1.2.1
Added Enable/Disable setting.
Fixed coppa includes file probem
Added file upload instructions to readme file.
1.2.0
Added JS timer to registration button.
Added enable/diable for email.
Removed ACP settings for random fields on rules and reg form pages and automated.
Reworded Pharses in ACP.
Recoded rules form and reg form edits.
Renamed variables for better code following.
Added more DB fields per user reg for tracking random automation.
New Hook on start_registration for functions.
Added new functions file. includes/stb_functions.php.
1.0.3
Changed input user name on rules form to random named hidden field with hash value.
Removed \n chars from email phrases.
All changes to registration are transparent to the folks registering.
Renamed DB username field to hash.
New hook on register_signup.
1.0.2
Added new Pre Reg Name hidden field to register form edits and ACP.
Added code to deal transparently with user deciding to change name after pre submitting it.
1.0.1
Fixed typo, changed 36000 to 3600 in product file.
1.0.0
Original Release.

[noppid]

I think we can handle a changed name better with a check on submission. If this don't match that, name was changed, lookup record with old name not new name.

I'm thinking about this before I pull the trigger on any code.

[noppid]

Name changes are dealt with now. And there is one more, unique to your site, hidden field added to the Registration form.

Great ideas folks! Ya'll can view the source code for the form at the demo site listed above in the mod description.

Let me read it over and see if I'm happy.

Upgrade will be to add one edit to the register template and install the product.

[Boofo]

Just curious, how did you do the name change? Sounds like you canceled the hash idea.

[Boofo]

A direct link to the source code would be better as there is no way I can figure out where it is on the site.

[noppid]

Sorry for the confusion, I meant view the HTML form code. The Code is not posted except in the release file here and that is the old code.

Yeah, the hash was getting over complicated. We deal with the name change by using a second hidden field and track it with a unique name you set.

Seems to be working and handling errors properly on my site. I had installed a bug and messed things up for a while. But we stomped it.

Anyway, if you view the two forms, you'll see where we grab the pre-name on forum rules and then place it in a hidden on the reg form. That allows for tracking the record and the name changing.

The Pre-reg name field on rules is settable, the hidden field name that saves it on the reg form is settable, and we have the settable hiddens on each form.

Lot's of confusion. I confused myself even coding it.

[soundbarrierpro]

Shouldn't the registration permissions implemented in vb script stop the bots already? Or is this a bot detector for possible bot attempts to register?

[Boofo]

Originally Posted by noppid

Sorry for the confusion, I meant view the HTML form code. The Code is not posted except in the release file here and that is the old code.

Yeah, the hash was getting over complicated. We deal with the name change by using a second hidden field and track it with a unique name you set.

Seems to be working and handling errors properly on my site. I had installed a bug and messed things up for a while. But we stomped it.

Anyway, if you view the two forms, you'll see where we grab the pre-name on forum rules and then place it in a hidden on the reg form. That allows for tracking the record and the name changing.

The Pre-reg name field on rules is settable, the hidden field name that saves it on the reg form is settable, and we have the settable hiddens on each form.

Lot's of confusion. I confused myself even coding it.

OK, well, I'll have to look at how you've done it before I decide if i want to install it. I'm not sure changing the way vb does the registration for the name is the way to go for me. I think it would be a little confusing to new members, but that is just me.

[maidos]

Originally Posted by Boofo

OK, well, I'll have to look at how you've done it before I decide if i want to install it. I'm not sure changing the way vb does the registration for the name is the way to go for me. I think it would be a little confusing to new members, but that is just me.

no, ur not alone, it would confuse other members aswell

[noppid]

Well, change is hard. Nothing changes what so ever on the registration page. People just have to type a name on the rules page now as well as check a box.

I set out to change it on purpose.

Instead of collecting the name and using that, we could GEN and Pass some hash off I guess. But as i said, my purpose was to make things different.

The more I type, the more I like passing the HASH. I didn't want to pass it. But that is more random and gives us control better.

Ok, you win. That's a better Idea. That changes things a lot for us and not for the user at all.

Easy turnover too.

[Boofo]

You DO suck up rather well.

But I think no changes for the user throws them off to what is really happening behind the scenes, which is what we want to do, right?