Over the last few days we have been getting spam customer registrations, every 90mins about 20 "accounts" are created in a few mins, with the first name being eg Рассадина Зинаида Пантелеймоновна, мы определили победителей совместного конкурса с помощью Google и Random.Org: https://www.google.com/#btnI=RandomOrg-%32&q=b%54%63%320%31%38rU

Its seems the idea is to spam using our welcome email with the link in the first name field going to a targets email ( we got a reported spam warning from hotmail)

We already have captcha running as suggested in this answer: https://stackoverflow.com/questions/47144150/preventing-spam-direct-post-request-customer-registrations-in-magento

and we have changed the maxlength on the create account page for the first and second name from 255 to 50 thinking at least we can stop the there goal of posting the long url link in the first name. But that is being bypassed and they are still able to post first names with 200+ characters.

Is there a way to enforce the 50 character limit?

  • use google recaptcha google.com/recaptcha/intro/invisible.html Commented Jun 4, 2018 at 12:17
  • @NikunjVadariya If you check the other question, its seems that google recaptcha does not work as the bots go it createpost directly, bypassing it
    – PaddyD
    Commented Jun 4, 2018 at 12:29
  • I am also getting exactly the same thing, magento captcha bypassed and also bypassed max fields. This answer: stackoverflow.com/questions/47144150/… Suggested that magento captcha should stop it, but like you I have magento captcha enabled and it hasn't stopped it. (Though I did increase the captcha to 8 chars + case sensitive and there are fewer, but not stopped 100%). I hope someone can shed some light on this soon :(
    – loginid
    Commented Jun 5, 2018 at 1:25
  • @loginid Looking at the logs the create accounts were coming from different ips but the ip requesting the captcha was always the same ip address in germany, so I going to try to block that ip, so see if that makes difference ( only a temp fix granted)
    – PaddyD
    Commented Jun 5, 2018 at 8:10
  • so blocking that ip address has stopped the last round of attempts of account creations, so it looks like they are using that to "read" the captcha, so that will stop them ... until they use a new ip
    – PaddyD
    Commented Jun 5, 2018 at 9:54

2 Answers 2


I had the same problem and solved it as follows.

Go with phpmyadmin to the database table customer_eav_attribute and edit the record 5 (attribute_id 5).

Edit content table column validate_rules -> max_text_length "; i: 255" to "-> max_text_length"; i: 65.

attribute_id 5 is the first name and the values in the validate_rules are checked before the update to the database.

Because the bot almost always enters 155 characters. Should it only be rejected from now on.

  • Thank you for your answer Rama. Is there a way of doing this via configuration rather than via the DB?
    – loginid
    Commented Jun 5, 2018 at 22:56
  • @Rama -> Unfortunately we did not find anything in the configuration in the backend. Also in the phtml files the maxlength = "" information does not work. We have also installed various honeypot extensions but without success. Only the database solution described above could stop the bot. We are happy that it works. Commented Jun 6, 2018 at 6:10
  • @TigrayM.L. - thanks for your suggestion. Blocking the ip accessing the captcha has been working for me so far, but I don't think that will last long, so I will try your suggestion once they start happening again. I was going to try a honeypot next (don't like installing too many extensions unless i have too), so interesting that you found they don't work.
    – PaddyD
    Commented Jun 6, 2018 at 8:25
  • Working solution! I set the limit to 25! Commented Sep 4, 2018 at 8:28
  • 1
    Thanks so much, this worked for me as well. However, I'm on magento and the attribute id for the first name and last name are attribute_id 1 and 2. Commented Jan 30, 2019 at 19:20

Please use the following code for adding google invisible captcha and the following code server-side validation.

<?php class Addpeople_Validatecaptcha_Model_Customer_Customer extends Mage_Customer_Model_Customer {

public function validate()
    $errors = array();
    if (!Zend_Validate::is( trim($this->getFirstname()) , 'NotEmpty')) {
        $errors[] = Mage::helper('customer')->__('The first name cannot be empty.');

    if (!Zend_Validate::is( trim($this->getLastname()) , 'NotEmpty')) {
        $errors[] = Mage::helper('customer')->__('The last name cannot be empty.');

    if (!Zend_Validate::is($this->getEmail(), 'EmailAddress')) {
        $errors[] = Mage::helper('customer')->__('Invalid email address "%s".', $this->getEmail());

    $password = $this->getPassword();
    if (!$this->getId() && !Zend_Validate::is($password , 'NotEmpty')) {
        $errors[] = Mage::helper('customer')->__('The password cannot be empty.');
    if (strlen($password) && !Zend_Validate::is($password, 'StringLength', array(self::MINIMUM_PASSWORD_LENGTH))) {
        $errors[] = Mage::helper('customer')
            ->__('The minimum password length is %s', self::MINIMUM_PASSWORD_LENGTH);
    if (strlen($password) && !Zend_Validate::is($password, 'StringLength', array('max' => self::MAXIMUM_PASSWORD_LENGTH))) {
        $errors[] = Mage::helper('customer')
            ->__('Please enter a password with at most %s characters.', self::MAXIMUM_PASSWORD_LENGTH);
    $confirmation = $this->getPasswordConfirmation();
    if ($password != $confirmation) {
        $errors[] = Mage::helper('customer')->__('Please make sure your passwords match.');

    $entityType = Mage::getSingleton('eav/config')->getEntityType('customer');
    $attribute = Mage::getModel('customer/attribute')->loadByCode($entityType, 'dob');
    if ($attribute->getIsRequired() && '' == trim($this->getDob())) {
        $errors[] = Mage::helper('customer')->__('The Date of Birth is required.');
    $attribute = Mage::getModel('customer/attribute')->loadByCode($entityType, 'taxvat');
    if ($attribute->getIsRequired() && '' == trim($this->getTaxvat())) {
        $errors[] = Mage::helper('customer')->__('The TAX/VAT number is required.');
    $attribute = Mage::getModel('customer/attribute')->loadByCode($entityType, 'gender');
    if ($attribute->getIsRequired() && '' == trim($this->getGender())) {
        $errors[] = Mage::helper('customer')->__('Gender is required.');

    if( Mage::getStoreConfig('validate_captcha/server_side_validation/enabled') ) {
        $errors = $this->validateCaptcha($errors);

    if (empty($errors)) {
        return true;
    return $errors;

private function validateCaptcha( $errors ) {

    /* additional reCAPTCHA validation */

    $action = Mage::app()->getRequest()->getActionName();
    if ( $action == 'createpost' ) {

        $captcha = Mage::app()->getRequest()->getPost('g-recaptcha-response', 1);
        if ( $captcha == '' ) {

            $errors[] = Mage::helper('customer')->__('Please check the reCAPTCHA field to continue.');
        } else {
            $params = array();
            $params['secret'] =  Mage::getStoreConfig('validate_captcha/server_side_validation/secret_key');
            $params['response'] = Mage::app()->getRequest()->getPost('g-recaptcha-response', 1);
            $params['remoteip'] = $_SERVER['REMOTE_ADDR'];

            $params_string = http_build_query($params);
            $url = 'https://www.google.com/recaptcha/api/siteverify?'.$params_string;

            $ch = curl_init();
            curl_setopt( $ch, CURLOPT_URL, $url );
            curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1);
            $response = curl_exec( $ch );

            $result = json_decode( $response, true );
            if ( trim( $result['success'] ) != true ) {

                // This will be shown at the top of the registration page
                $errors[] = Mage::helper('customer')->__('reCAPTCHA unable to verify.');


Please refer my website for layout and config file.


  • where is code added? "Please use the following code for adding google invisible captcha and the following code server-side validation", that wording seems to imply the are 2 different sets to code to be added in 2 different places, can you explain more please?
    – PaddyD
    Commented Jun 24, 2019 at 10:11
  • This answer is extremely vague, most users are going to be looking at this and trying to search more detail on how to do this and it's over complicated. Magento's back end has the functionality to add the captcha which should be enough in most cases and if not alternative methods on top such as the answer for the field limitation as an example. Commented May 13, 2020 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.