View source for Reducing spam in Moodle

==Background==

What exactly is the problem?  Read [[Why porn spam has been appearing in Moodle sites|why porn spam has been appearing in Moodle sites]].

==The best thing to do==

Upgrade to 1.9.4 or later and use the new [[Security_overview| Security report]] to analyse your configuration.  Then do all the things it tells you.

Note this is not strictly necessary to combat just profile spam (see the critical settings below) but it will protect you against dozens of other known security vulnerabilities.

==Critical settings==

# Make sure that 'register_globals' is switched '''off''' in your PHP settings (this is the default).  Otherwise your site may be at risk of being cracked, allowing spammers to modify your scripts and insert spam wherever they like.
# Keep "Force users to login for profiles" '''enabled''' in ''Administration > Security > [[Site policies]]'' to prevent anonymous visitors and search engines from seeing user profiles.
# Keep "Profiles for enrolled users only" '''enabled''' in ''Administration > Security > [[Site policies]]'' (in Moodle 1.6.9, 1.7.7, 1.8.8 and in 1.9.4 onwards).

==Strong recommendations==

*Make sure you '''upgrade your site often'''.  Recent versions of Moodle have new fixes and warnings that will help you avoid security issues.
*Consider the [[Risks|spam risks]] involved in allowing certain capabilities for visitor accounts, such as [[Capabilities/mod/forum:replypost| replying to forum posts]] or posting to blogs.

==Allowing self-registration==

If you don't need it, please keep self-registration '''disabled''' (it's the default) in ''Administration > Users > Authentication > [[Manage authentication]]'' common settings.  

If you '''must''' use [[Email-based self-registration]] to allow people to make their own accounts then:
# Add spam protection to the new account form by enabling reCAPTCHA (in Moodle 1.9.1 onwards) - see [[Security FAQ]] for details of how to do so. ReCAPTCHA is quite effective against '''most''' automated spambots, but will not foil human spammers at all.
# Limit self registration to particular email domains with the allowed email domains setting or deny email addresses from particular domains, such as mailinator.com and temporaryinbox.com, with the denied email domains setting. Both settings are in ''Administration > Users > Authentication > [[Manage authentication]]'' common settings.
# Consider only enabling self registration for a short period of time to allow users to create accounts, and then later disable it.
# Keep "Email change confirmation" enabled in ''Administration > Security > [[Site policies]]'' (in Moodle 1.8.6 and in 1.9.2 onwards).

==Cleaning up spam==

If your site was open in the past and you have a spam problem then here are some things you can do to clean up the profiles:

# Use our [[Spam cleaner]] in Moodle 1.8.9 and 1.9.5 onwards (or a script for using in versions of Moodle prior to 1.8.9 or 1.9.5).
# Browse your user list looking for patterns to detect users who need to be deleted.  For example, spammers might have chosen a country that none of your real users has.
# Use the "Bulk user actions" tool under Admin > Users > Accounts to find all these users and delete them.   Note that versions prior to 1.6.7, 1.7.5, 1.8.6, 1.9.2 had a [http://moodle.org/mod/forum/discuss.php?d=101407 bug] that did not properly hide deleted user profiles, so make sure you have upgraded to a later version if you want to keep user profiles visible to the world.

[[Category:Security]]

[[eu:Spama_murriztu_Moodle-n]]
[[fr:Réduire le spam]]
[[ja:Moodleでスパムを減らすには]]