作成中です - Mitsuhiro Yoshida 2008年11月4日 (火) 05:08 (CST)
- Leave "Force users to login for profiles" enabled in Administration > Security > Site policies to keep anonymous visitors and search engines away from user profiles.
- Leave self registration disabled in Administration > Users > Authentication > Manage authentication common settings, or limit self registration to particular email domains with the allowed email domains setting, or only enable self registration for a short period of time to allow users to create accounts, and then later disable it.
- If Email-based self-registration is used for self registration, add spam protection to the new account form by enabling reCAPTCHA (in Moodle 1.9.1 onwards). However, please realize that a) CAPTCHA will not foil manual attempts and there are documented CAPTCHA exploits now documented. In other words, CAPTCHA is NOT an ANSWER. It is only one more obstacle you might implement to discourage spammers.
- If Email-based self-registration is used for self registration, leave "Email change confirmation" enabled in Administration > Security > Site policies (in Moodle 1.8.6 or 1.9.2 onwards).
- Consider the spam risks involved in allowing certain capabilities, such as replying to forum posts, for visitor accounts.
If your site was open and you have a spam problem then here are some things you can do to clean up the profiles:
- Browse your user list looking for patterns to detect users who need to be deleted. For example, spammers might have chosen a country that none of your real users has.
- Use the "Bulk user actions" tool under Admin > Users > Accounts to find all these users and delete them. Note that versions prior to 1.6.7, 1.7.5, 1.8.6, 1.9.2 had a bug that did not properly hide deleted user profiles, so make sure you have upgraded to a later version if you want to keep user profiles visible to the world.
- Some tools should shortly be available to make it easier to detect and delete profiles containing common spam content. Check back here for details.