Eliminating Bot Spam on phpBB 2 Boards

If you run a phpBB 2.0.x mes­sage board, you likely get spam. If you don’t get spam, you likely have either just started your board or have a spe­cial blend of secu­rity set­tings and mod­i­fi­ca­tions that you have found to work.

Thanks to inspi­ra­tion & code (used with per­mis­sion) from the Raven’s Anti­spam Plu­gin for Word­Press, I have put together the 1 phpBB mod­i­fi­ca­tion that you shouldn’t be liv­ing without!

Why do I say that? Because it works. I have been using it on The Fel­low­ship Hall, and it has become so spam-free that I have enabled guest post­ing & dis­abled visual con­fir­ma­tion with­out worry.

Down­load Raven’s Anti­spam from the Extras page.

So what does the Raven’s Anti­spam phpBB MOD do? How does it stop spam at the door?

The prin­ci­ple is sim­ple: when­ever a guest accesses the post­ing screen or the reg­is­tra­tion screen, Raven’s Anti­spam goes into action. It dynam­i­cally gen­er­ates a unique pair of ran­dom strings which are not only unique to the board being accessed but also to the day upon which it is accessed. This pre­vents bots from “learn­ing” the answer, and yet the MOD does not require data­base mod­i­fi­ca­tion, unlike sim­i­lar anti­spam MODs! That’s right, you should not have to mess with your data­base just to remain spam free!

After the pair of strings are gen­er­ated, they are plugged into the reg­is­tra­tion or guest post­ing screens. One of the strings is used as a form input name; the other is the expected value of that field. The dynamic form field name is impor­tant — it keeps bots from rec­og­niz­ing the field upon repeat vis­its or upon see­ing the sim­i­lar field on mul­ti­ple boards. Again, the name is going to be unique per board per day!

One of the beau­ti­ful things about Raven’s Anti­spam is that, if JavaScript is enabled in the guest’s browser, there is noth­ing the user has to do! The field is dynam­i­cally filled in using JavaScript, and the user can post or reg­is­ter unhin­dered in any way.

If JavaScript is dis­abled, the user is required only to fill in a form field — no dif­fi­cult to dis­cern visual tests are required!

Why does this MOD work?

Sim­ple:

* Most spam is posted by auto­mated bots.
* Most, if not all, bots do not inter­pret JavaScript.

So, the required form field isn’t auto­mat­i­cally filled out, nor does the bot know that an addi­tional form needs filled out to reg­is­ter or post, and so spam bots are effec­tively stopped!

Down­load Raven’s Anti­spam from the Extras page.

Caveats: This MOD will not stop spam posted by humans, nor is it meant to.
This MOD will also not stop spam bots that are devel­oped to under­stand JavaScript, nor is it meant to. If such bots exist, I’ve yet to hear about them.

I rec­om­mend hav­ing a backup plan to block spam in place. On the Hall, we’re set up with bbPro­tec­tion as our second-line of defense. How­ever, bbPro­tec­tion is no longer report­ing a usage graph for the Hall for the past month, as Raven’s Anti­spam has blocked all spam prior to hav­ing to be screened by bbProtection!