How to stop XenForo spam posts from members who got past sign-up

XenForo's sign-up checks stop most spam bots, but some spammers still get an account. Once they're members, nothing asks them to prove anything again. To stop XenForo spam posts from those accounts, hold new members' first posts, filter what they write, clean up fast, and ask questions at posting time.

Why spam gets past sign-up

XenForo has good defenses at the door. In the Spam management options you can check each new sign-up against the StopForumSpam database. You can check the visitor's IP address against DNS block lists, and set a registration timer that catches scripts filling in the form too fast.

Then there's the CAPTCHA, set under Options > Basic board information. XenForo offers reCAPTCHA and its own question-and-answer CAPTCHA, and the choice of providers depends on your version. You can use one type at a time.

The catch is where the CAPTCHA applies. It runs when someone registers, and when guests post if you allow guest posting. A registered member never sees it again. So an account that got through, whether run by a person or a script, can post freely.

That's why most XenForo spam posts come from accounts that already exist. The rest of this guide covers the second line of defense: what happens when those accounts try to post.

Hold new members' first posts for approval

The strongest defense is simple. Make the first few posts of every new member wait for a moderator. Spammers rarely write several useful posts before they start advertising, so the queue catches them.

XenForo's manual shows how to do it with a user group promotion:

1. Edit the Registered user group and set the permission "Submit content without approval" to No.
2. Create a new user group, such as "Verified member", and set the same permission to Yes.
3. Create a user group promotion that adds members to "Verified member" once they have posted at least five messages.

New members' posts now go to the approval queue until the promotion runs. Promotions run on a schedule, not the moment someone makes their fifth post. So expect a short wait after that.

If permissions are new to you, our guide to XenForo permissions explains how group and user permissions combine.

Catch XenForo spam posts by what they say

Holding posts works, but it adds work for your moderators. Two content checks in the Spam management options take some of it off their hands.

Spam phrases

You can list phrases that spam tends to use. If one of a member's first few messages matches, XenForo takes the action you chose, such as blocking the message. An asterisk works as a wildcard. XenForo's own example is "watch * online", which matches a whole family of pirate film spam.

Keep the list short and specific. Broad phrases catch real members too.

Akismet

For content that changes too often for a phrase list, XenForo can check new messages with Akismet. It's an outside service that judges whether content looks like spam. When it thinks so, the message goes to your moderation queue until someone approves or deletes it.

Clean up fast with the spam cleaner

Some spam will still get through. When it does, XenForo's spam cleaner removes a spammer and their content in a few clicks.

Staff with the spam cleaner permission see a Spam link next to Edit and Delete on a message. The same link is in the member's tools menu and on their profile. The spam cleaner can ban the account, remove their threads and messages, and check whether other members share their IP address.

By default the Spam link only shows for newer accounts with few messages. You can change those limits under "Spam cleaner user criteria" in the Spam management options.

Made a mistake? Tools > Spam cleaner log lets you restore what the spam cleaner removed, unless it was deleted for good. If you have a StopForumSpam API key, banning a spammer this way can also report them back to StopForumSpam.

Ask a question when members post

The checks above react to spam. Asking a question at posting time stops more of it before it's written. XenForo's own CAPTCHA can't do this for members, so it takes an add-on.

Our Captcha Questions on Posting add-on shows members a question from your list when they post. A different random question appears each time the page loads. You decide where it applies:

• New threads, replies or both.
• Only in the forums you choose.
• Only for members below a post count, reaction score or account age you set, so trusted members aren't asked.
• With or without a hint under the question.

Ask questions that any real member of your community can answer, but a script can't guess. A car forum might ask which pedal makes a car stop. It works on XenForo 2.2 and 2.3.

Common questions

Will holding first posts put off new members?

It can, if posts sit in the queue for days. Check the approval queue often, and keep the number of held posts small. XenForo's own example holds five. Telling members up front also helps.

Should I use reCAPTCHA or question-and-answer?

Both work at sign-up. Questions about your forum's topic are hard for generic spam scripts to guess, but you have to write and refresh them. Never publish the answers anywhere on your forum.

What if spam comes from an older account?

Raise the spam cleaner's user criteria so the Spam link shows for that account. Then remove the XenForo spam posts and ban the account in one step.

What to do next

• Turn on the StopForumSpam check and a CAPTCHA for registrations, if they aren't already on.
• Set up approval for new members' first posts with a user group promotion.
• Add a short list of spam phrases, and consider Akismet.
• Check that your moderators have the spam cleaner permission.
• If spam still comes from members, add questions at posting time.

Our XenForo security guide covers the rest of your forum's defenses. Still seeing XenForo spam posts after all this? Open a support ticket and tell us what they look like.