My online store receives a huge number of new users creation (over 500 new users per 30 seconds)

So, I enabled captcha for new accounts, the new accounts creation have stopped but I get thousands of new captcha verification images in


more than 113000 new image whithin 2 houres

I passed my DNS through Cloudflare and marked visitors from China, India, Russia (the source countries of the attack), they must pass the Cloudflare challenge before accessing the site, but I still receive a new account creation attempts from Hong Kong for exemple

but in case I activate the mode "under attack", it stops all those attempts but all store visitors are invited to wait 5 seconds before accessing the store (Cloudflare)

I am using Magento 2.2.5

  • 1
    I had the same issue. I resolved it by creating an observer event when customer is created and log the source details, after that I blocked those from htaccess. Commented Aug 26, 2018 at 6:34
  • the problem is that if I authorize the creation of new clients, I will get thousands of fake users; and it does not make sense if I block them after
    – SoCix
    Commented Aug 26, 2018 at 11:31

1 Answer 1


I solved this problem by passing my DNS through Cloudflare and blacklisting some countries source of those attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.