Spambots

[Hitcher]

Hi Team,

I've noticed we've been dealing with a heavy influx of spambots lately. To help save you some time, I used an AI assistant to research the most effective, up-to-date anti-spam configurations specifically for MyBB forums.

The AI highlighted that modern automated bots easily bypass our current default CAPTCHA, but MyBB has some great native tools and plugins that can stop them at the root. Here is the action plan it generated for us to permanently fix the issue:

1. Quick Fix: Add Custom Q&A Verification (No Plugins Needed)
Automated bots cannot solve custom text questions.

• Where to find it: Admin CP > Configuration > Question Verification
  
• What to do: Add 2–3 unique questions. For example: "What is the main topic of Fanrestore?" (Answer: restoration / film) or a simple instruction like "Type the word 'FAN' in lowercase letters."
  

2. Upgrade the CAPTCHA to hCaptcha (Free & Native)
MyBB natively supports hCaptcha, which is vastly superior to the default visual CAPTCHA at stopping automated registration scripts.

• Where to find it: Admin CP > Configuration > General Configuration > Captcha Images
  
• What to do: Select hCaptcha from the dropdown. You just need to grab a free API Key and Secret Key from hCaptcha's website, paste them in, and save.
  

3. Automated Defense: "Stop Forum Spam" Plugin
Instead of us manually banning spammers after they post, this official plugin blocks them at the door by checking their IP and email against a global database of known spammers during registration.

• The Plugin: MyBB Stop Forum Spam Plugin
  

4. Damage Control: Limit New Accounts
If a bot somehow slips through, we can kill their incentive to spam by adjusting MyBB user group permissions:

• Moderate First Posts: Set permissions so a user's first 1 or 2 posts require mod approval before going live.
  
• Disable Links: Prevent new accounts from adding links to their signatures or profiles until they reach a minimum post count (e.g., 3 posts). This completely breaks the SEO benefit the spammers are looking for.
  

Hopefully, these AI-suggested steps give us a quick roadmap to shut the bots down.

[Feallan]

Hi, thanks for the suggestions, appreciate them. Problem is, points 1, 2 and 3 are already implemented and have been for years. I've considered point 4 and decided against it as I felt it wouldn't necessarily save us time (purging a spammer takes 3 seconds and this persistent one will eventually just give up, approving all new accounts will be more effort), but if this spammer continues to be a nuisance, I'll have no other choice.

I can also add more custom Q&A questions, but either it's an actual human being shoveling his garbage into our forum, in which case, he will just learn all answers to the questions - or AI bots are so good now they can beat hCaptcha already, in which case the questions will also do nothing.