How to prevent spam account registration, aside from enabling CAPTCHA on forms (which I've already tried)? We're dealing with a steady flood of them.

The first name field is always Russian characters, so failing an easier route, maybe a way to detect a certain character and blocking the registration in that case?

  • Or if anyone has had similar issues but has had luck with modules, etc, please let me know. – brackfost Jul 13 '18 at 17:05

We went through the same problem, the front maxlength limitation was bypassed easily (try it yourself by removing the maximum-length-25 class from html).

So here are what I found :

  • Solution 1 : Blocking via IP : each account subscription use a different IP from Colombia to Vietnam...

  • Solution 2: Blocking via User agent : it can be faked... It works if you want to limit crawlers blots.

  • Solution 3: Use HoneyPot : may works, but if the bot already focused you, I think it surely knows which fields to post (see: https://magento.stackexchange.com/a/104261/50635)

  • Solution 4: Captcha (Magento or Google) : may works but some people said it was overpassed

  • Solution 5: Edit email template and Add the confirmation email :

    • Removing input data such as {{var customer.name}}, {{var customer.firstname}} from the /app/locale/[locale]/template/email/account_new.html template can prevent a bit being marked as spam.
    • Add the email confirmation : System > Configuration > Customer Configuration > Require Emails Confirmation > Yes
  • Solution 6: Update fields limitation rules from database : directly in the customer_eav_attribute table, update rows with attribute_id=5 [firstname] and attribute_id=7 [lastname] and replace 255 by 25 :

    • a:2:{s:15:"max_text_length";i:255;s:15:"min_text_length";i:1;}
    • by : a:2:{s:15:"max_text_length";i:25;s:15:"min_text_length";i:1;}

Solution 6 seems the fastest and the more effective way to prevent spambots, as they are using more than 25 characters.

Since then, NO MORE FAKE ACCOUNT were created! Problem solved.

If they try with less, it will at least restrict them in their phishing attempt.

You can check how many users already have a firstname or lastname over 25 characters, in our case, really minor :

SELECT ce.entity_id, ce.email, cev2.value AS firstname, cev3.value AS lastname
FROM customer_entity ce
-- first name
INNER JOIN customer_entity_varchar cev2 ON (ce.entity_id = cev2.entity_id AND cev2.attribute_id = 5)
-- last name
INNER JOIN customer_entity_varchar cev3 ON (ce.entity_id = cev3.entity_id AND cev3.attribute_id = 7)
WHERE CHAR_LENGTH(cev2.value)>25 or CHAR_LENGTH(cev3.value)>25

For more information why these fake accounts are registered, read here : https://magento.stackexchange.com/a/240710/50635

  • 1
    Hi, For the solution 6 you mentioned above. What should i do for Magento 2.2.6? my validate_rules shows "{"max_text_length":225,"min_text_length":1}", and there is also an input_filter: "trim". should i remove that, and just edit the 225 to 25? thanks – Kris Wen Mar 18 '19 at 16:26
  • Try to replace 225 by 25, then test if it works – DependencyHell Mar 19 '19 at 17:06
  • 3
    i tried replace 225 by 25, and take out the "trim" yesterday, but still getting new spams today. i opened a new question just now: magento.stackexchange.com/questions/266564/… – Kris Wen Mar 19 '19 at 17:08
  • Yeah, I thought I would try the quick fix here on my installation and my validate_rules field looks like @KrisWen version. Changing 255 to 25 in there, however, did not work and I can sign up with huge last names etc still. – harri Aug 3 '20 at 11:33
  • i ended up using the third party Recaptcha extension from mageplaza, which works well, and the spam stopped. I also blocked those known IPs to blacklist. – Kris Wen Aug 6 '20 at 17:12

Considering that we are talking about Account Registration, seems that you are on the right way. Have you tried changing the email registration subject?

it is probably on app/locale/yourlanguage/template/email/account_new.html


As a supplementary note, I deleted the spam accounts with the following code:

$customers = $this->getCustomerCollection();

$this->registry->register('isSecureArea', true);

function isRussian($text) {
    return preg_match('/[А-Яа-яЁё]/u', $text);

foreach($customers as $customer){
  $name = $customer->getName();
  • This doesn't solve the issue – Gezzasa Dec 27 '18 at 10:31
  • Personally, I used DependencyHell's solution 6. Just wanted to include this in case anyone else needed to mass-delete Russian spam. – brackfost Dec 27 '18 at 19:02
  • Hi, how should i run this code? i'm on magento 2.2.6. thanks – Kris Wen Mar 18 '19 at 16:37
  • Hey @KrisWen, I'm not sure if this will make other users roll their eyes, but I'd just put in a template in your custom module. In my case, I stuck it in App/Code/Ibex/Deleter/view/frontend/templates/customer.phtml and then made a deleter_index_index.xml file in Deleter/view/frontend/layout with <block class="Ibex\Deleter\Block\Delete" name="delete" template="Ibex_Deleter::character.phtml"/> in there so that when you go to yoursite.com/deleter the code would run. Just be sure to deactivate and delete the module afterwards. – brackfost Mar 18 '19 at 18:23
  • haha thank you! @TryingestFool I have some confusion about the original selected answer. do you happen to know? -->"Hi, For the solution 6 you mentioned above. What should i do for Magento 2.2.6? my validate_rules shows "{"max_text_length":225,"min_text_length":1}", and there is also an input_filter: "trim". should i remove the trim, and just edit the number from 225 to 25?" – Kris Wen Mar 18 '19 at 21:28

Use cloudflare or some other firewall to block some countries if you can. China, Hong Kong, Russia. This does not stop all the spam however and does not work if you need those countries to be able to access of course. But it was helpful to let me actually use the admin panel as the server was getting hammered pretty hard.

Enable the build in Google Recaptcha or use an alternative plugin if you have not updated Magento to 2.3.0+

In Magento 2.3 to enable the built in Google reCAPTCHA.

1) Visit Stores > Settings > Configuration > Security > Google reCAPTCHA 2) Generate Recaptcha v2 invisible recaptcha or I'm not a bot keys. 3) Enter them into the admin config on that page and enable it on the frontend for Use in Create user.

Enabling for other features can't really hurt either however.

For cleaning up existing accounts find patterns in their input and create queries to select them whilst ensuring your normal users are not part of that set of data.

You can delete them from the customer_entity table.

Example SQL from a site I cleaned up: Craft your own as it would need to be mindful of your circumstances your dataset etc don't hold me responsible if you wipe wrong users take backup first!

DELETE FROM customer_entity
WHERE SUBSTRING_INDEX(email, '\@', -1) IN ('pp.com',
OR lastname LIKE '%http://%'
OR lastname LIKE '%https://%'
OR lastname LIKE '%【%】%'
OR lastname LIKE '%tw55.cc%'
OR lastname LIKE '%www.ope2228.com%'

Ensure the old basic Magento Captcha is disabled. Customers > Customer Configuration > CAPTCHA

Enable CAPTCHA on Storefront: No

As it will conflict with the Google reCAPTCHA...

Official documentation links:



The bots just seem to hit the account creation endpoint (Yes even if you delete the Create Account buttons/links from your theme) but deleting their accounts or deactivating is recommended as they could sleep till later and spam other things and they use up space in your DB anyway....

Good luck everyone.


You can easily put the domains to block and set the error message to be displayed when a user attempts to register with an email domain on your block list. Full instructions are as follows –

Create a new module with a name EmailCheck in the folder Ecomsolver

Step – 1 Write the following code at admin panel. Path of the file will be – Ecomsolver >EmailCheck > etc > Adminhtml > System

<?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd"> <system> <tab id="ecomsolver" translate="label" sortOrder="999"> <label>Ecomsolver</label> </tab> <section id="emailblock" translate="label" sortOrder="130" showInDefault="1" showInWebsite="1" showInStore="1"> <class>separator-top</class> <label>Email Check</label> <tab>ecomsolver</tab> <resource>PixieMedia_General::general_config</resource> <group id="domains" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="1" showInStore="1"> <label>Domain Names</label> <field id="domains" translate="label" type="textarea" sortOrder="1" showInDefault="1" showInWebsite="1" showInStore="1"> <label>Domain names to block</label> <comment>Comma separated values eg google.co.uk,mail.ru,some.com</comment> </field> <field id="message" translate="label" type="textarea" sortOrder="1" showInDefault="1" showInWebsite="1" showInStore="1"> <label>Message to display</label> <comment>The error message to show users who try to register with one of the above domain names</comment> </field> </group> </section> </system> </config>

Step – 2 Write the following code in a file. Path of the file will be – Ecomsolver >EmailCheck > etc > Frontend > di

<?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd"> <type name="Magento\Customer\Controller\Account\CreatePost"> <plugin name="restrictCustomerEmail" type="Ecomsolver\Emailcheck\Model\Plugin\Controller\Account\RestrictCustomerEmail"/> </type> </config>

Step – 3 Write the following code in XML file with name Config. Path of the file will be – Ecomsolver >EmailCheck > etc > Config

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd"> <default> <emailblock> <domains> <domains>163.com,mail.ru</domains> </domains> <message> <domains>We do not allow registration from your email domain</domains> </message> </emailblock> </default> </config>

Step – 4 Write the following code in XML file with name Module. Path of the file will be – Ecomsolver >EmailCheck > etc > Module

<config xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:noNamespaceSchemaLocation="../../../../../lib/internal/Magento/Framework/Module/etc/module.xsd"> <module name="Ecomsolver_Emailcheck" setup_version="1.0.0"> </module> </config>

Step – 5 Create the folder name Model in EmailCheck. Then create subfolder Plugin > Controller > Account. Write the following code in php file with name RestrictCustomerEmail. Path of the php file will be – Ecomsolver >EmailCheck > Plugin > Controller > Account > RestrictCustomerEmail

/*Ecomsolver @@@@@@ ecomsolver@gmail.com*/ namespace Ecomsolver\Emailcheck\Model\Plugin\Controller\Account; use Magento\Framework\Controller\Result\RedirectFactory; use Magento\Framework\UrlFactory; use Magento\Framework\Message\ManagerInterface; use Magento\Framework\App\Config\ScopeConfigInterface; class RestrictCustomerEmail {

  * @var \Magento\Framework\UrlInterface

protected $urlModel;

 * @var \Magento\Framework\Controller\Result\RedirectFactory

protected $resultRedirectFactory;

 * @var \Magento\Framework\Message\ManagerInterface
protected $messageManager;
 * RestrictCustomerEmail constructor.
 * @param UrlFactory $urlFactory
 * @param RedirectFactory $redirectFactory
 * @param ManagerInterface $messageManager
public function __construct(
    UrlFactory $urlFactory,
    RedirectFactory $redirectFactory,
    ManagerInterface $messageManager,
    ScopeConfigInterface $scopeConfig
    $this->urlModel = $urlFactory->create();
    $this->resultRedirectFactory = $redirectFactory;
    $this->messageManager = $messageManager;
    $this->scopeConfig = $scopeConfig;
 * @param \Magento\Customer\Controller\Account\CreatePost $subject
 * @param \Closure $proceed
 * @return mixed
 * @throws \Magento\Framework\Exception\LocalizedException
public function aroundExecute(
    \Magento\Customer\Controller\Account\CreatePost $subject,
    \Closure $proceed
    /** @var \Magento\Framework\App\RequestInterface $request */
    $email = $subject->getRequest()->getParam('email');
    list($nick, $domain) = explode('@', $email, 2); 
    $domains = $this->scopeConfig->getValue('emailblock/domains/domains', \Magento\Store\Model\ScopeInterface::SCOPE_STORE);
    if(!$domains) { 
        return $proceed; 
    $domainArray = array_map('trim', explode(',', $domains));
    if(count($domainArray) < 1) { 
        return $proceed;
    if (in_array($domain, $domainArray, true)){
    $message = $this->scopeConfig->getValue('emailblock/domains/message', \Magento\Store\Model\ScopeInterface::SCOPE_STORE);
        if(!$message) { $message = __('We do not allow registration from your email domain'); }
        $defaultUrl = $this->urlModel->getUrl('*/*/create', ['_secure' => true]);
        /** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
        $resultRedirect = $this->resultRedirectFactory->create();
        return $resultRedirect->setUrl($defaultUrl);
    return $proceed();

I have resolved it by adding the following code to .htaccess as debugging lot, I didn't found anything but when create one event on customer save after I got this and then its resloved now.

<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} "rv:40\.0\)\ Gecko/20100101\ Firefox/40\.1$" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko.*Gecko" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/([a-z]|[A-Z])\." [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/\ " [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/20([2-9])" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/201([1-9])"
  • Hi, thanks for your response. What does the above do exactly, and how did you determine to target Gecko, etc? – brackfost Jul 12 '18 at 16:18
  • 2
    I have detected it by customer save event. This is Russian bots. So you can disable them by that code. Also if it not works then you also need write an event when customer saves and write log for $_Server and $_request then debug it – Sukumar Gorai Jul 12 '18 at 16:28
  • User agents found : Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36 and Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 – DependencyHell Sep 3 '18 at 16:11
  • Now you can add it in your htaccess and solve the issue – Sukumar Gorai Sep 3 '18 at 17:49
  • We cannot block this user agent because we have a lot of visitors with this one. This one does not specify a famous bot, but a common user agent... – DependencyHell Sep 4 '18 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.