Poor Bot Protection

  • Burke Ingraffia

    (@burkeingraffia)


    2 months, 1 week ago

    This plugin seems to have a lot of good features, but it gets hit often with 30 bot registrations at a time of free accounts every day until I deactivate the plugin. I do not have Anyone can register checked in Settings >> General. I have tried:

    1. Captcha v2 plugin
    2. Captcha V3 plugin
    3. Creating a session token with a timer that doesn’t allow fast registrations
    4. Hidden honeypot form fields.

    Nothing works. Meanwhile it is causing my domain is sending out spammy notifications to what seem like some real email addresses.

    I might just pay for a membership plugin or use Patreon.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support mbrsolution

    (@mbrsolution)

    2 months, 1 week ago

    Thank you @burkeingraffia, for your 2 star review. We appreciate this very much.

    Sorry to hear about your security issue due to too many spammer registrations. This can happen sometimes if your site is targeted by spammers. Unfortunately this can also be a bit challenging to overcome. However, we also have the following Cloudflare Turnstile integration you might like to try.

    https://simple-membership-plugin.com/simple-membership-and-cloudflare-turnstile-integration-addon/

    Let me know if the information above helps you in any way.

    Kind regards.

    Plugin Author wp.insider

    (@wpinsider-1)

    2 months ago

    The bot issue you’re experiencing is not specific to this plugin. When a CAPTCHA solution fails to block bots, it usually indicates that something in your site or server environment is interfering with how the plugin functions.

    In most cases, it requires an investigation to determine which combination of settings, plugins, or server configurations might be causing the issue.

    Trying an alternative plugin/solution that isn’t affected by your current setup is a good idea and may yield better results.

    I share some additional information below that can be helpful if a site is targeted by bots.

    If you are experiencing spam registrations, follow these steps to identify the source of it first. Then appropriate measures can be taken to solve the issue.

    1. Enable Debug Logging
      Turn on the debug logging feature within the plugin. This can help you analyze registration attempts, identify patterns, and determine if bots are bypassing the CAPTCHA.
    2. Check WordPress Registration Settings
      Go to WordPress Admin Dashboard → Settings → General and ensure that the “Anyone can register” option is disabled. Leaving this option enabled can allow bots to bypass membership registration restrictions.
    3. Review API Access Settings
      If you have enabled the Create members via API option, double-check if it is necessary. Some users unknowingly enable this feature when working with freelancers, who might then share the API secret, making the site vulnerable to spam registrations. If you do not require API-based registrations, disable this option.
    4. Verify CAPTCHA Integration
      • Test the CAPTCHA functionality by attempting a registration yourself.
      • If the CAPTCHA is not showing up, check for JavaScript errors in the browser console, as theme or plugin conflicts can prevent it from working properly.
      • Ensure that you have correctly configured the CAPTCHA keys in the settings.
    5. Check for Hidden Registration Forms
      Some themes and plugins create additional registration forms that might not be protected by CAPTCHA.
      • Search for hidden or alternative registration pages on your site.
      • Ensure that CAPTCHA protection is enabled for all relevant forms.

    Try the Alternative Cloudflare Turnstile Captcha
    If you haven’t tried it already, I would recommend that you try this alternative captcha solution which is really good – Cloudflare Turnstile Captcha

Viewing 2 replies - 1 through 2 (of 2 total)
  • You must be logged in to reply to this review.