I am getting a LOT of spammers creating accounts on my Drupal 6 site so I have turned off user registration in User Settings (Only site administrators can create new user accounts). But it has not stopped the spammers from trying to create new accounts! I am still seeing 10-20 new registration attempts every day.

Is there a security hole that allows spammers to bypass the normal site registration restrictions?

When I try going to http://www.bikesonshow.com/user/register I get a 404 error, which is what I would expect to see. So where are the spammers going to add their registration details?

Comments

pixelsweatshop’s picture

pixelsweatshop commented
Status: Active » Closed (works as designed)

These are automated bots and they are trying to poke to see if you have set your permissions improperly so they can spam your site. You can leave registration turned off or add a captcha or honeypot to keep the amount down. You are never going to get rid of it 100%. That's what happens when you use a popular CMS like Drupal. They are going to prod known URLS to gain access. It will be the same for any other major CMS. You can also go higher up in the stack and start blocking IPs that are known to exploit or are from regions you are not servicing. No matter what, don't lose sleep over it. If you have set your permissions correctly and keep your site up to date, you are fine.