Why NotBot?

NOTE: This readme file can also be viewed at /admin/help/notbot

Almost all Drupal installations are subject to fake user registrations by web 
bots that target the /user/register page.

The NotBot module creates a special visitor registration page at a unique 
location (url) specified by a site administrator.

This registration page, referred to as the NotBot page, is special in that it 
allows visitor registration without administrators approval regardless of the 
Public Registration option set on the Account Settings page.

To implement the NotBot registration page, the site administrator creates 
either a link or Drupal menu item somewhere on the website that links to the 
NotBot page, preferably with some kind of context to inform a real visitor how 
and where they can sign up as a member.

The standard page at /user/register behaves exactly the same as before. 
The behavior of both the /user/register page and the NotBot page depends on 
which Public Registration option has been selected on User Settings page.


Installation

Install the NotBot module as you would any other contributed module. There 
are no special permissions to set. A new field is added to the Account Settings 
page that allows a site administrator to specify the location of the NotBot 
directory.


Public Registration options

There are 3 options for Public Registrations. The behavior of each registration 
page (/user/register vs. NotBot) is as follows:

1) Only site administrators can create new user accounts

When this option set the standard /user/register is off limits to everybody 
except site administrators. The NotBot page is still available at the 
designated url.

2) Visitors can create accounts and no administrator approval is required.

With this option set, any user may create a new account. The standard 
/user/register page and the NotBot page behave exactly the same with this 
option set. In fact, there is no point in having the NotBot module installed if 
this site option is selected.

3) Visitors can create accounts but administrator approval is required.

Users (web bots) that register at /user/register must wait for administrator 
approval. Real users that register with NetBot page are immediately sent an 
email verification login notice (if enabled). No administrator approval required.


Missing links

The NotBot module removes all standard Drupal links to the /user/register page 
(i.e. User Login block) to eliminate the possibility that a real user will 
use this page. The only means of viewing the /user/register page is to enter 
their url on the address line.


Drupal 7 Bonus feature

The block titles on the User menu and the Navigation menu are changed to 
the username for authenticated users.

Actually, Drupal 6 already did this, so why not D7?


Selecting the best option

Consider setting option #3 above as the site setting. Since all links to the 
/user/register page have been removed, the only visitors to this page are 
either real people that know it is a Drupal site or Drupal programmed web 
bots that target /user/register.

The page at /user/register page will present the standard form to a web bot 
and will respond with an email that is tailored for the situation, and place 
that visitor on the admin wait list.

Consider the above as a strategy to discourage further web bot searching. 
If a web bot has found the form, completed it, and received a response, chances 
are it will wait for approval. Selecting option #1 means that the /user/register 
page returns a 403 (Forbidden) code . This may serve as a signal to the web bot 
to search the website for another link.


Create a link for the real user

A link to the NotBot page can be added to any page on the website that somehow 
directs a real user to where and how to register. The link can also be 
fashioned as a custom Drupal menu item.

The path to the NotBot registration page may be changed by visiting the 
admin/config/people/accounts page. The default path on installation is 
/notbot (of course). It is recommended this be changed for all kinds of reasons.


Suggested menu item

A suggested menu item (New members) can be found on the Navigation menu. It 
may be enabled and moved to a suitable location.


Tips, Tricks & Traps

To view the NotBot registration page you must be an anonymous visitor. Either 
logout or use another browser to view (and test) the NotBot page.

If you enable option #3 above, then web bots that visit the standard Drupal 
user/register page can be advised in a detailed email, loaded with complex 
legal language, on the terms and conditions of membership. Somewhere in those 
terms it can be mentioned that they, the applicant, will be approved as 
soon as pigs fly.

If you enable option #3 above, then web bots that visit the standard Drupal 
user/register page can be safely ignored forever because, with the Notbot module 
enabled and properly configured, no real visitor would actually make use of the 
/user/register page.

