When offering to create a profile (for example, login+pwd) for a web service, what are the best practices one should implement to avoid mass spamming/creation of fake profiles? I am thinking about email confirmation, captchas, etc... any other ideas that work in practice?
A very good idea to avoid mass profile making without adding a captcha (let's admit it, even when you know they are for the good, captchas can be just annoying) is to make a hidden
You check if this element is filled up: then it usually means it was a bot: in this case you give the bot a false
I think you should consider using an SMS or email verification method in addition to a CAPTCHA. You should also consider logging IP addresses who create accounts and if someone attempts to register another account with in a time window you should deny it or ask for further verification.
Another approach you could take would be to have moderators and make sure there are no spam-type accounts.
You could also watch the user behaviour to identify spam accounts: - Is the form filled in very quickly for signup - Does any interaction appear to be preprogrammed
You need to find the right mix of preventative measures to prevent legitimate users from being harmed.
Some services require you to enter a verification code sent to your phone by text. Its quite effective at stopping bots but does take some effort on your part to set up though.
protected by MichaelT Jan 6 at 19:29
Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?