How to solve the problem of Drupal website being maliciously registered by machine users

Source: Internet
Author: User
Tags mysql client drupal

Many junk registrations @ are found on my Drupal site. Although the honeypot module has been enabled, this type of registration is not blocked.


Attackers may be familiar with the honeypot mechanism and can write scripts to achieve malicious registration.

In the Drupal system, by default, user registration logs are stored in the watchdog table. By analyzing the user logs in the watchdog table, you can collect the relevant information for reference.

Then, the user block module or other corresponding modules are used to shield the registration of the malicious IP address.


Execute the following SQL statement on any mysql client:
Select count (hostname) as count, hostname from watchdog where type = "user" group by hostname order by count desc;

The following statistical results can be obtained:
| Count | hostname |
+ ------- + ----------------- +
| 53 | |
| 31 | |
| 20 | |
| 4 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |

We can see that there are a large number of accesses to the IP segment We found that the ip address is located in the United States in Because the website is mainly for Chinese users, it can be determined that this is the ip source for malicious registration.

Drupal's default ip blocking policy does not support blocking IP segments. You can use the ip ranges module to block ip segments.

Additional considerations:

Using the Drupal module to block the issue, you can solve the problem by clicking the mouse, it is easier. At the same time, permissions can be granted to relevant personnel to reduce the burden on developers.

The best way is to shield the IP address on the server layer. nginx and apache have corresponding configurations to block access to the specified IP address and IP address segment. This method consumes less system resources. The disadvantage is that the configuration is troublesome and you need to log on to the server for operations.
Here we recommend a Chinese verification code template, if your Drupal site is for Chinese users:


Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.