100+ bots managed to register over the past week or two and then this morning around 6:30 am they all started posting random advertisements for very questionable businesses.
By the time I was awake and aware of the situation the forums were pretty bad. But I did end up getting rid of over a hundred spam posts and accounts. It is also possible that I deleted some legitimate accounts because they had ‘spammish’ emails and/or usernames.
As of right now, I added a new plugin which requires a verification email to be sent before an account can be activated and can post on the forums. As far as I know, that is the defacto way to keep spammers out. I set the plugin to be in a very strict mode so I have to verify every single registration before the verification email is even sent*. This is temporary while I try to figure out how to make our registration forum more secure with captcha/recaptcha/etc.
*Edit: I will try to check multiple times a day, so if anyone registers they should receive the verification email within a few hours. After clicking the verification link you will need to login to use your account.
