How to prevent spam account registration, aside from enabling CAPTCHA on forms (which I've already tried)? We're dealing with a steady flood of them.

The first name field is always Russian characters, so failing an easier route, maybe a way to detect a certain character and blocking the registration in that case?

  • Or if anyone has had similar issues but has had luck with modules, etc, please let me know.
    – brackfost
    Commented Jul 13, 2018 at 17:05

7 Answers 7


We went through the same problem, the front maxlength limitation was bypassed easily (try it yourself by removing the maximum-length-25 class from html).

So here are what I found :

  • Solution 1 : Blocking via IP : each account subscription use a different IP from Colombia to Vietnam...

  • Solution 2: Blocking via User agent : it can be faked... It works if you want to limit crawlers blots.

  • Solution 3: Use HoneyPot : may works, but if the bot already focused you, I think it surely knows which fields to post (see: https://magento.stackexchange.com/a/104261/50635)

  • Solution 4: Captcha (Magento or Google) : may works but some people said it was overpassed

  • Solution 5: Edit email template and Add the confirmation email :

  • Removing input data such as {{var customer.name}}, {{var customer.firstname}} from the /app/locale/[locale]/template/email/account_new.html template can prevent a bit being marked as spam.
  • Add the email confirmation : System > Configuration > Customer Configuration > Require Emails Confirmation > Yes
  • Solution 6: Update fields limitation rules from database : directly in the customer_eav_attribute table, update rows with attribute_id=5 [firstname] and attribute_id=7 [lastname] and replace 255 by 25 :

    • a:2:{s:15:"max_text_length";i:255;s:15:"min_text_length";i:1;}
    • with : a:2:{s:15:"max_text_length";i:25;s:15:"min_text_length";i:1;}
    • MySQL update statement below.

Solution 6 seems the fastest and the more effective way to prevent spambots, as they are using more than 25 characters. Use this SQL:

UPDATE customer_eav_attribute SET validate_rules = 'a:2:{s:15:"max_text_length";i:25;s:15:"min_text_length";i:1;}' WHERE attribute_id IN (5,7);

Since then, NO MORE FAKE ACCOUNT were created! Problem solved.

If they try with less, it will at least restrict them in their phishing attempt.

You can check how many users already have a firstname or lastname over 25 characters, in our case, really minor :

SELECT ce.entity_id, ce.email, cev2.value AS firstname, cev3.value AS lastname
FROM customer_entity ce
-- first name
INNER JOIN customer_entity_varchar cev2 ON (ce.entity_id = cev2.entity_id AND cev2.attribute_id = 5)
-- last name
INNER JOIN customer_entity_varchar cev3 ON (ce.entity_id = cev3.entity_id AND cev3.attribute_id = 7)
WHERE CHAR_LENGTH(cev2.value)>25 or CHAR_LENGTH(cev3.value)>25

For more information why these fake accounts are registered, read here : https://magento.stackexchange.com/a/240710/50635

  • 1
    Hi, For the solution 6 you mentioned above. What should i do for Magento 2.2.6? my validate_rules shows "{"max_text_length":225,"min_text_length":1}", and there is also an input_filter: "trim". should i remove that, and just edit the 225 to 25? thanks Commented Mar 18, 2019 at 16:26
  • Try to replace 225 by 25, then test if it works Commented Mar 19, 2019 at 17:06
  • 3
    i tried replace 225 by 25, and take out the "trim" yesterday, but still getting new spams today. i opened a new question just now: magento.stackexchange.com/questions/266564/… Commented Mar 19, 2019 at 17:08
  • Yeah, I thought I would try the quick fix here on my installation and my validate_rules field looks like @KrisWen version. Changing 255 to 25 in there, however, did not work and I can sign up with huge last names etc still.
    – harri
    Commented Aug 3, 2020 at 11:33
  • i ended up using the third party Recaptcha extension from mageplaza, which works well, and the spam stopped. I also blocked those known IPs to blacklist. Commented Aug 6, 2020 at 17:12

Use cloudflare or some other firewall to block some countries if you can. China, Hong Kong, Russia. This does not stop all the spam however and does not work if you need those countries to be able to access of course. But it was helpful to let me actually use the admin panel as the server was getting hammered pretty hard.

Enable the build in Google Recaptcha or use an alternative plugin if you have not updated Magento to 2.3.0+

In Magento 2.3 to enable the built in Google reCAPTCHA.

  1. Visit Stores > Settings > Configuration > Security > Google reCAPTCHA
  2. Generate Recaptcha v2 invisible recaptcha or I'm not a bot keys.
  3. Enter them into the admin config on that page and enable it on the frontend for Use in Create user.

Enabling for other features can't really hurt either however.

For cleaning up existing accounts find patterns in their input and create queries to select them whilst ensuring your normal users are not part of that set of data.

You can delete them from the customer_entity table.

Example SQL from a site I cleaned up: Craft your own as it would need to be mindful of your circumstances your dataset etc don't hold me responsible if you wipe wrong users take backup first!

DELETE FROM customer_entity
WHERE SUBSTRING_INDEX(email, '\@', -1) IN ('pp.com',
OR lastname LIKE '%http://%'
OR lastname LIKE '%https://%'
OR lastname LIKE '%【%】%'
OR lastname LIKE '%tw55.cc%'
OR lastname LIKE '%www.ope2228.com%'

Way 1: Enable Google reCAPTCHA

Ensure the old basic Magento Captcha is disabled. Customers > Customer Configuration > CAPTCHA

Enable CAPTCHA on Storefront: No

As it will conflict with the Google reCAPTCHA...

Official documentation links:



Way 2: add SpamUsersFilter Plugin


<type name="Magento\Customer\Model\AccountManagement">
        <plugin disabled="false" name="MyCompany_ValidateAttributeLength_Plugin_Magento_Customer_Model_AccountManagement" sortOrder="10" type="MyCompany\ValidateAttributeLength\Plugin\Magento\Customer\Model\AccountManagement"/>


namespace MyCompany\ValidateAttributeLength\Plugin\Magento\Customer\Model;

use \Magento\Framework\Exception\LocalizedException;

class AccountManagement

    public function beforeCreateAccount(
        \Magento\Customer\Model\AccountManagement $subject,
        $regexp = '/(?:(?:https?|ftp|file):\/\/|www\.|ftp\.)(?:\([-A-Z0-9+&@#\/%=~_|$?!:,.]*\)|[-A-Z0-9+&@#\/%=~_|$?!:,.])*(?:\.[A-Z0-9]{1,})\.?/im';
        $firstName = $customer->getFirstname();
        $lastName = $customer->getLastname();

        if (strlen($firstName) > 70 || strlen($lastName) > 70) {
            throw new \Exception(__("Name to long"));
        } elseif (preg_match($regexp, $lastName . $firstName)) {
            throw new LocalizedException(__("Site name doesn't allowed"));

The bots just seem to hit the account creation endpoint (Yes even if you delete the Create Account buttons/links from your theme) but deleting their accounts or deactivating is recommended as they could sleep till later and spam other things and they use up space in your DB anyway....

Good luck everyone.

  • great help to solve captcha spam issue
    – matinict
    Commented May 22, 2021 at 10:05
  • I ended up adding those common spam emails to a list in an extension that blocks registrations with them. I think it was something like this, but it had a UI with an edit box in the admin. magento.stackexchange.com/questions/157742/… Sure it would be an issue if you have customers using those emails. But here in my country they are not really used. Commented May 22, 2021 at 10:31

Considering that we are talking about Account Registration, seems that you are on the right way. Have you tried changing the email registration subject?

it is probably on app/locale/yourlanguage/template/email/account_new.html


As a supplementary note, I deleted the spam accounts with the following code:

$customers = $this->getCustomerCollection();

$this->registry->register('isSecureArea', true);

function isRussian($text) {
    return preg_match('/[А-Яа-яЁё]/u', $text);

foreach($customers as $customer){
  $name = $customer->getName();
  • This doesn't solve the issue
    – Gezzasa
    Commented Dec 27, 2018 at 10:31
  • Personally, I used DependencyHell's solution 6. Just wanted to include this in case anyone else needed to mass-delete Russian spam.
    – brackfost
    Commented Dec 27, 2018 at 19:02
  • Hi, how should i run this code? i'm on magento 2.2.6. thanks Commented Mar 18, 2019 at 16:37
  • Hey @KrisWen, I'm not sure if this will make other users roll their eyes, but I'd just put in a template in your custom module. In my case, I stuck it in App/Code/Ibex/Deleter/view/frontend/templates/customer.phtml and then made a deleter_index_index.xml file in Deleter/view/frontend/layout with <block class="Ibex\Deleter\Block\Delete" name="delete" template="Ibex_Deleter::character.phtml"/> in there so that when you go to yoursite.com/deleter the code would run. Just be sure to deactivate and delete the module afterwards.
    – brackfost
    Commented Mar 18, 2019 at 18:23
  • haha thank you! @TryingestFool I have some confusion about the original selected answer. do you happen to know? -->"Hi, For the solution 6 you mentioned above. What should i do for Magento 2.2.6? my validate_rules shows "{"max_text_length":225,"min_text_length":1}", and there is also an input_filter: "trim". should i remove the trim, and just edit the number from 225 to 25?" Commented Mar 18, 2019 at 21:28

You can easily put the domains to block and set the error message to be displayed when a user attempts to register with an email domain on your block list. Full instructions are as follows –

Create a new module with a name EmailCheck in the folder Ecomsolver

Step – 1 Write the following code at admin panel. Path of the file will be – Ecomsolver >EmailCheck > etc > Adminhtml > System

<?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd"> <system> <tab id="ecomsolver" translate="label" sortOrder="999"> <label>Ecomsolver</label> </tab> <section id="emailblock" translate="label" sortOrder="130" showInDefault="1" showInWebsite="1" showInStore="1"> <class>separator-top</class> <label>Email Check</label> <tab>ecomsolver</tab> <resource>PixieMedia_General::general_config</resource> <group id="domains" translate="label" type="text" sortOrder="10" showInDefault="1" showInWebsite="1" showInStore="1"> <label>Domain Names</label> <field id="domains" translate="label" type="textarea" sortOrder="1" showInDefault="1" showInWebsite="1" showInStore="1"> <label>Domain names to block</label> <comment>Comma separated values eg google.co.uk,mail.ru,some.com</comment> </field> <field id="message" translate="label" type="textarea" sortOrder="1" showInDefault="1" showInWebsite="1" showInStore="1"> <label>Message to display</label> <comment>The error message to show users who try to register with one of the above domain names</comment> </field> </group> </section> </system> </config>

Step – 2 Write the following code in a file. Path of the file will be – Ecomsolver >EmailCheck > etc > Frontend > di

<?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd"> <type name="Magento\Customer\Controller\Account\CreatePost"> <plugin name="restrictCustomerEmail" type="Ecomsolver\Emailcheck\Model\Plugin\Controller\Account\RestrictCustomerEmail"/> </type> </config>

Step – 3 Write the following code in XML file with name Config. Path of the file will be – Ecomsolver >EmailCheck > etc > Config

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd"> <default> <emailblock> <domains> <domains>163.com,mail.ru</domains> </domains> <message> <domains>We do not allow registration from your email domain</domains> </message> </emailblock> </default> </config>

Step – 4 Write the following code in XML file with name Module. Path of the file will be – Ecomsolver >EmailCheck > etc > Module

<config xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:noNamespaceSchemaLocation="../../../../../lib/internal/Magento/Framework/Module/etc/module.xsd"> <module name="Ecomsolver_Emailcheck" setup_version="1.0.0"> </module> </config>

Step – 5 Create the folder name Model in EmailCheck. Then create subfolder Plugin > Controller > Account. Write the following code in php file with name RestrictCustomerEmail. Path of the php file will be – Ecomsolver >EmailCheck > Plugin > Controller > Account > RestrictCustomerEmail

/*Ecomsolver @@@@@@ [email protected]*/ namespace Ecomsolver\Emailcheck\Model\Plugin\Controller\Account; use Magento\Framework\Controller\Result\RedirectFactory; use Magento\Framework\UrlFactory; use Magento\Framework\Message\ManagerInterface; use Magento\Framework\App\Config\ScopeConfigInterface; class RestrictCustomerEmail {

  * @var \Magento\Framework\UrlInterface

protected $urlModel;

 * @var \Magento\Framework\Controller\Result\RedirectFactory

protected $resultRedirectFactory;

 * @var \Magento\Framework\Message\ManagerInterface
protected $messageManager;
 * RestrictCustomerEmail constructor.
 * @param UrlFactory $urlFactory
 * @param RedirectFactory $redirectFactory
 * @param ManagerInterface $messageManager
public function __construct(
    UrlFactory $urlFactory,
    RedirectFactory $redirectFactory,
    ManagerInterface $messageManager,
    ScopeConfigInterface $scopeConfig
    $this->urlModel = $urlFactory->create();
    $this->resultRedirectFactory = $redirectFactory;
    $this->messageManager = $messageManager;
    $this->scopeConfig = $scopeConfig;
 * @param \Magento\Customer\Controller\Account\CreatePost $subject
 * @param \Closure $proceed
 * @return mixed
 * @throws \Magento\Framework\Exception\LocalizedException
public function aroundExecute(
    \Magento\Customer\Controller\Account\CreatePost $subject,
    \Closure $proceed
    /** @var \Magento\Framework\App\RequestInterface $request */
    $email = $subject->getRequest()->getParam('email');
    list($nick, $domain) = explode('@', $email, 2); 
    $domains = $this->scopeConfig->getValue('emailblock/domains/domains', \Magento\Store\Model\ScopeInterface::SCOPE_STORE);
    if(!$domains) { 
        return $proceed; 
    $domainArray = array_map('trim', explode(',', $domains));
    if(count($domainArray) < 1) { 
        return $proceed;
    if (in_array($domain, $domainArray, true)){
    $message = $this->scopeConfig->getValue('emailblock/domains/message', \Magento\Store\Model\ScopeInterface::SCOPE_STORE);
        if(!$message) { $message = __('We do not allow registration from your email domain'); }
        $defaultUrl = $this->urlModel->getUrl('*/*/create', ['_secure' => true]);
        /** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
        $resultRedirect = $this->resultRedirectFactory->create();
        return $resultRedirect->setUrl($defaultUrl);
    return $proceed();

As an extension to the ticked answer by DependencyHell above. Here is the MySQL statement you can run to reduce the max field length to 25 characters. Since this, we have had no more signup spam.

UPDATE customer_eav_attribute SET validate_rules = 'a:2:{s:15:"max_text_length";i:25;s:15:"min_text_length";i:1;}' WHERE attribute_id IN (5,7);

Update (5th March 2022):

I installed the Hackathon Magento Honey Spam extension and the spam has stopped. I have also updated to OpenMage LTS and it also seems to work and continue to prevent spam. I thought this might be helpful to someone.


I have resolved it by adding the following code to .htaccess as debugging lot, I didn't found anything but when create one event on customer save after I got this and then its resloved now.

<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} "rv:40\.0\)\ Gecko/20100101\ Firefox/40\.1$" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko.*Gecko" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/([a-z]|[A-Z])\." [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/\ " [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/20([2-9])" [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} "Gecko/201([1-9])"
  • Hi, thanks for your response. What does the above do exactly, and how did you determine to target Gecko, etc?
    – brackfost
    Commented Jul 12, 2018 at 16:18
  • 2
    I have detected it by customer save event. This is Russian bots. So you can disable them by that code. Also if it not works then you also need write an event when customer saves and write log for $_Server and $_request then debug it Commented Jul 12, 2018 at 16:28
  • User agents found : Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36 and Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Commented Sep 3, 2018 at 16:11
  • Now you can add it in your htaccess and solve the issue Commented Sep 3, 2018 at 17:49
  • We cannot block this user agent because we have a lot of visitors with this one. This one does not specify a famous bot, but a common user agent... Commented Sep 4, 2018 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.