Is the Forum Busted?

[TLS Guy]

@gene sorry. It didn't work. I just dumped 15 spam posts.

That is very bad news. How are these slum bag bots registering? I suspect we have to make registration more onerous in that case.

 

[lovinthehd]

ADK cleaned it up good I guess, with this new forum look no notifications from spammers at least.....

 

[Squishman]

I get that annoying pop-up that has tech articles, buying guides, join us on facebook. Way too frequent. It'd be nice to not have that so often.

 

[Squishman]

I get that annoying pop-up that has tech articles, buying guides, join us on facebook. Way too frequent. It'd be nice to not have that so often.

Oh.... I just noticed, don't accidentally hover your mouse over the category bar and it won't pop-up.

 

[lovinthehd]

Oh.... I just noticed, don't accidentally hover your mouse over the category bar and it won't pop-up.

Was gonna say, I don't get those....

 

[Dude#1279435]

Sure looks beautiful now with the updates.

 

[mtrycrafts]

Sure looks beautiful now with the updates.

It looks different. Need to get used to it.

 

[TLS Guy]

These vile spammers are at it again. I have just seen off a bunch. I think we need to make it much harder to get on the forum as a new member. I am getting really tired of this.

 

[adk highlander]

I know. I am still coming on every 6 hours or so to clean up. Sorry for the noise. I can only clean and don't have any ability to remediate more than that.

 

[TLS Guy]

I know. I am still coming on every 6 hours or so to clean up. Sorry for the noise. I can only clean and don't have any ability to remediate more than that.

I assumed that. However, I don't think this is tenable long term, so the owners need to find a way to stop it.

Do you know how they can do all those registrations so quickly. I assume those vile people have put together some automated process. There has to be a way to defeat that. Those posts have so many identifying parts and are nothing like someone coming on here to have a problem sorted out.

 

[adk highlander]

I assumed that. However, I don't think this is tenable long term, so the owners need to find a way to stop it.

Do you know how they can do all those registrations so quickly. I assume those vile people have put together some automated process. There has to be a way to defeat that. Those posts have so many identifying parts and are nothing like someone coming on here to have a problem sorted out.

Unfortunately I don't. I would believe there is a captcha and an email authorization like other forums but again it is outside my viewability.

 

[mono-bloc]

Whatever you think your doing to stop the continued placement of SPAM . Isn't working. 6 pages today

I'm on a number of Audio forums, none of which are having the troubles your having. So whatever your doing is a complete waste of time. All the spammers have to do is click the button, and the spams are automatically downloaded

 

[BoredSysAdmin]

Unfortunately I don't. I would believe there is a captcha and an email authorization like other forums but again it is outside my viewability.

Att. site admins:
@gene @Steve81

Here are some (hopefully) helpful suggestions from Claude:

Here are effective strategies to reduce bot spam on a XenForo forum:


Registration Controls

• Enable CAPTCHA (Google reCAPTCHA v3 or hCaptcha) under Admin > Options > User Registration
• Add custom registration questions with answers only real users would know (e.g., "What is the name of this forum?")
• Enable email verification for new accounts
• Set a minimum time to complete registration (bots fill forms instantly)

Q&A Verification
XenForo has a built-in Q&A system — use obscure, forum-specific questions bots can't easily guess. Avoid generic math questions since bots solve those.


New User Restrictions

• Limit new users to a "moderated" usergroup where posts require approval before going public
• Set a minimum post count before users can post links or images (a major spam incentive)
• Restrict new users from posting URLs until they've been a member for X days

Add-ons Worth Installing

• [bd] Anti-Spam by xAPI — checks registrations against spam databases
• StopForumSpam integration — cross-references email/IP against known spam lists
• KeyCAPTCHA or Are You a Human
• [XTR] Stop Spam Here — popular community add-on

IP & Email Filtering

• Use Stop Forum Spam (stopforumspam.com) and Project Honey Pot blacklists
• Ban disposable email domains (mailinator, guerrillamail, etc.) under Admin > Options > User Registration > Banned Emails
• Enable IP banning for repeat offenders

Post-Registration Moderation

• Put all new users in a moderated queue for their first 1–5 posts
• Use the Spam Cleaner tool (built into XenForo) to quickly nuke spam accounts and all their posts at once
• Set up Spam Phrases (Admin > Options > Spam Management) to auto-flag posts containing typical spam keywords

Honey Pot Technique
Some add-ons add an invisible form field — real users ignore it, bots fill it in and get blocked automatically.


Manual Oversight

• Appoint active moderators with spam-cleaner permissions
• Enable "Report" buttons so users can flag spam quickly
• Review the new members list daily during high-spam periods

The most effective combo for most forums is: reCAPTCHA v3 + custom Q&A + StopForumSpam integration + new user post moderation. That alone stops the vast majority of bots without much friction for legitimate users.

 

[BoredSysAdmin]

Here's a step-by-step guide to integrating reCAPTCHA v3 with XenForo:


Step 1: Get Your reCAPTCHA v3 API Keys

1. Go to google.com/recaptcha
2. Sign in with your Google account
3. Click Admin Console → + (Create new site)
4. Fill in:
   • Label: your forum name
   • reCAPTCHA type: reCAPTCHA v3
   • Domains: your forum's domain (e.g. yourforum.com)
5. Accept terms → Submit
6. Copy your Site Key and Secret Key

Step 2: Enter Keys in XenForo Admin Panel

1. Log into your XenForo Admin Control Panel (ACP)
2. Go to Setup → Options → User Registration
3. Find the CAPTCHA section
4. Select reCAPTCHA v3 from the dropdown
5. Paste your Site Key and Secret Key into the fields
6. Set your preferred score threshold (default is 0.5 — higher = stricter)
7. Click Save

Step 3: Configure the Score Threshold


reCAPTCHA v3 works by scoring users from 0.0 (likely bot) to 1.0 (likely human):

Score	Meaning
0.9 – 1.0	Almost certainly human
0.5 – 0.8	Likely human
0.3 – 0.4	Suspicious
0.0 – 0.2	Likely bot

• 0.5 is a safe default to start with
• Lower it (e.g. 0.3) if too many real users are getting blocked
• Raise it (e.g. 0.7) if bots are still getting through

Step 4: Test It

1. Open your forum in an incognito window
2. Go through the registration flow
3. Check your Google reCAPTCHA Admin Console → you'll see score analytics showing real traffic vs. suspected bots

Step 5: Combine with XenForo's Spam Management


Go to Setup → Options → Spam Management and configure:

• Spam phrases to auto-flag suspicious posts
• StopForumSpam API key (free at stopforumspam.com) for extra protection
• Moderation queue for new users with low post counts

Troubleshooting Tips

• If legitimate users are being blocked, lower your score threshold
• If the CAPTCHA isn't appearing, make sure your domain in Google Console exactly matches your forum URL (with/without www)
• XenForo 2.2+ has native reCAPTCHA v3 support — older versions may need the [bd] Anti-Spam add-on
• Disable any caching plugins temporarily to confirm the CAPTCHA loads correctly

That's it — reCAPTCHA v3 runs invisibly in the background, so it adds strong bot protection without any friction for your real users.

 

[BoredSysAdmin]

Here's how to integrate StopForumSpam with XenForo:




Step 1: Get Your StopForumSpam API Key

1. Go to stopforumspam.com
2. Click Register and create a free account
3. After logging in, go to My Account → API Keys
4. Click Add API Key, give it a label (e.g. "MyForum")
5. Copy the generated API key

Step 2: Enter the API Key in XenForo

1. Log into your XenForo Admin Control Panel (ACP)
2. Go to Setup → Options → Spam Management
3. Find the Stop Forum Spam section
4. Paste your API key into the Stop Forum Spam API Key field
5. Click Save

Step 3: Configure Spam Management Options


While in Setup → Options → Spam Management, configure these settings:


Registration Checks

• Enable Check username against Stop Forum Spam — flags known spammer usernames
• Enable Check email against Stop Forum Spam — blocks disposable/known spam emails
• Enable Check IP against Stop Forum Spam — blocks IPs with spam history

Thresholds
XenForo lets you set what happens when a match is found:

Action	When to use
Reject registration	High-confidence spam matches
Flag for moderation	Medium-confidence matches
Allow but moderate posts	Low-confidence, to avoid false positives

A good starting config:

• Set frequency threshold to 2–3 (how many times the email/IP has been reported)
• Set confidence threshold to 75–80% for rejections

Step 4: Configure Spam Trigger Actions


Go to Setup → Options → Spam Management → Spam Trigger Action:

• Reject — completely blocks the registration (best for obvious spam)
• Moderation — puts the user in a moderated state requiring admin approval
• Allow — lets them in but flags them for review

Recommended setup:

• High score matches → Reject
• Medium score matches → Moderation queue

Step 5: Set Up Banned Emails & IPs


While you're in the ACP, also configure:

1. Setup → Banning → Banned Emails — add common disposable email domains:
   
   • mailinator.com
   • guerrillamail.com
   • tempmail.com
   • throwam.com
   • yopmail.com
2. Setup → Banning → Banned IP Addresses — manually ban repeat offender IPs

Step 6: Reporting Spam Back to StopForumSpam


This helps the community database grow — when you ban a spammer, report them back:

1. In XenForo, when using the Spam Cleaner tool on a user:
   
   • Check Submit to Stop Forum Spam before cleaning
   • This submits their username, email, and IP to the SFS database automatically
2. You can also manually submit via your SFS account dashboard

Step 7: Test the Integration

1. Go to stopforumspam.com/lookup
2. Enter a known spam email or IP to confirm it's in the database
3. Try registering on your forum with that email — it should be blocked
4. Check ACP → Logs → Spam Prevention Log to see what's being caught

Recommended Combined Setup


For maximum protection with minimal false positives:


reCAPTCHA v3 (score: 0.5)
+
StopForumSpam (frequency: 2+, confidence: 75%+)
+
Custom Q&A questions
+
New user post moderation (first 3–5 posts)


This layered approach stops the vast majority of bots at registration before they ever make a single post.

 

[TLS Guy]

Here's how to integrate StopForumSpam with XenForo:




Step 1: Get Your StopForumSpam API Key

1. Go to stopforumspam.com
2. Click Register and create a free account
3. After logging in, go to My Account → API Keys
4. Click Add API Key, give it a label (e.g. "MyForum")
5. Copy the generated API key

Step 2: Enter the API Key in XenForo

1. Log into your XenForo Admin Control Panel (ACP)
2. Go to Setup → Options → Spam Management
3. Find the Stop Forum Spam section
4. Paste your API key into the Stop Forum Spam API Key field
5. Click Save

Step 3: Configure Spam Management Options


While in Setup → Options → Spam Management, configure these settings:


Registration Checks

• Enable Check username against Stop Forum Spam — flags known spammer usernames
• Enable Check email against Stop Forum Spam — blocks disposable/known spam emails
• Enable Check IP against Stop Forum Spam — blocks IPs with spam history

Thresholds
XenForo lets you set what happens when a match is found:

Action	When to use
Reject registration	High-confidence spam matches
Flag for moderation	Medium-confidence matches
Allow but moderate posts	Low-confidence, to avoid false positives

A good starting config:

• Set frequency threshold to 2–3 (how many times the email/IP has been reported)
• Set confidence threshold to 75–80% for rejections

Step 4: Configure Spam Trigger Actions


Go to Setup → Options → Spam Management → Spam Trigger Action:

• Reject — completely blocks the registration (best for obvious spam)
• Moderation — puts the user in a moderated state requiring admin approval
• Allow — lets them in but flags them for review

Recommended setup:

• High score matches → Reject
• Medium score matches → Moderation queue

Step 5: Set Up Banned Emails & IPs


While you're in the ACP, also configure:

1. Setup → Banning → Banned Emails — add common disposable email domains:
   • mailinator.com
   • guerrillamail.com
   • tempmail.com
   • throwam.com
   • yopmail.com
2. Setup → Banning → Banned IP Addresses — manually ban repeat offender IPs

Step 6: Reporting Spam Back to StopForumSpam


This helps the community database grow — when you ban a spammer, report them back:

1. In XenForo, when using the Spam Cleaner tool on a user:
   • Check Submit to Stop Forum Spam before cleaning
   • This submits their username, email, and IP to the SFS database automatically
2. You can also manually submit via your SFS account dashboard

Step 7: Test the Integration

1. Go to stopforumspam.com/lookup
2. Enter a known spam email or IP to confirm it's in the database
3. Try registering on your forum with that email — it should be blocked
4. Check ACP → Logs → Spam Prevention Log to see what's being caught

Recommended Combined Setup


For maximum protection with minimal false positives:


reCAPTCHA v3 (score: 0.5)
+
StopForumSpam (frequency: 2+, confidence: 75%+)
+
Custom Q&A questions
+
New user post moderation (first 3–5 posts)


This layered approach stops the vast majority of bots at registration before they ever make a single post.

Would you be willing to assist admin with that? It sounds as if it is just what is required. This can't go on, or it will bring the forum to an end.

 

[Jeepers]

Would you be willing to assist admin with that? It sounds as if it is just what is required. This can't go on, or it will bring the forum to an end.

Thank you BoredSysAdmin for your posts on how to possibly solve this issue and indeed it would be useful as suggested by TLS Guy to assist the admin with this. However; how come these things haven't been installed yet after all this time...if that is the case ?

 

[BoredSysAdmin]

Would you be willing to assist admin with that? It sounds as if it is just what is required. This can't go on, or it will bring the forum to an end.

I'm not an expert in XenForo, but I've been doing all sorts of IT for the last 25 years, so I think I'd figure it out. But I think the instructions I've left might be sufficiently easy to follow.
Again, these are Claude-generated, so they might not be 100% accurate, but I've seen that Claude responses are genereally higher accuracy than Copilot and ChatGPT.