Justin Parr

<h3>Update: 6/2015</h3>
<p>Changed e-mail token and math problem confirmation logic.  Previously, everything happened all at once, and the user would get prompted mutliple times for the math problem.<br />
Now, the user must answer the math problem first, before the e-mail token is sent.  Once the math problem is correctly answered within the session, it isn’t asked again.  The user must now enter the correct token, which results in successful registration.<br />
SPECIAL THANKS TO OLEG M. FOR HELPING ME IDENTIFY, FIX, AND TEST THE ERROR!!</p>
<h3>Update: 5/2015</h3>
<p>Added E-mail confirmation token.  Prevents registration until user enters a token sent via e-mail.</p>
<h3>Features:</h3>
<ul>
<li>Prevent users from registering, if their IP or e-mail address is listed in the “Comments” blacklist (Settings..Discussion)</li>
<li>E-mails user a 4-digit token, and requires the user to enter the token in order to register.</li>
<li>Users must solve a simple math problem (Add two one-digit numbers).</li>
<li>Places user IP address in “Website” field.</li>
</ul>
<p>This is a super-simple user registration spam countermeasure.  I searched for a plugin that was SIMPLE and EFFECTIVE.  I looked at quite a few plugins that promised the desired effect, but were either cumbersome, or included too many unneeded or unwanted features.  Likewise, there are some very simple plugins that are less-than-effective.</p>
<h3>This plugin is VERY simple:</h3>
<p>If the user’s IP or e-mail address is listed in the “Discussion” comments blacklist, it prevents the user from registering.  This functionality should really be built in to WordPress, so, you’re welcome.</p>
<p>When the user registers, they are presented with a simple math problem – adding a 3-digit number to a 1-digit number.  99% of the “user reg spam” is based on bots being able to attack the basic WordPress registration form.  By adding even a simple math problem, most bots will fail, removing your site as a target of opportunity.  Criminals go after what’s easy – if you make it slightly more difficult for them, they will go after someone else.</p>
<p>Once the user solves the math problem, they are sent a 4 digit token via e-mail, and must enter that token to continue registration.</p>
<p>Finally, knowing the location from where your users register allows you to more effectively evaluate and block the source.  This plugin adds the user’s IP address (at the time of registration)  to the “Website” field.</p>
<p>Go to http://whois.arin.net to find out who they are.  If you decide to block the IP,  add the IP address, part of the IP address, or e-mail domain to the “Discussion” comments blacklist, and ANY user registrations from an IP address matching that pattern will be blocked.</p>
<h3>Configuration</h3>
<h3>To Configure the Plugin:</h3>
<p>NOTE:  NO CONFIGURATION IS REQUIRED.  This plugin is fully-functional using the default values.</p>
<p>In the Plugins page, click “Settings” underneath the “JP User Registration Blacklist” plugin.</p>
<ul>
<li>
<p>Seed:  This value determines how the answer to the math problem is masked.  Periodically change this, to keep the spammers and criminals at bay.  The initial value is randomly-generated.</p>
</li>
<li>
<p>Failed Math Response:  Error message displayed to the user, if they fail to correctly solve the math problem.</p>
</li>
<li>
<p>Rejected IP or E-mail:  Error message displayed to the user, if their IP or e-mail is blocked.  Keep this simple and generic, to keep them from knowing why they are being blocked.</p>
</li>
<li>
<p>Form field name for math problem:  This field name contains the user’s answer to the math problem.  Periodically change this, to keep the bots away.  The initial value is randomly-generated.</p>
</li>
</ul>
<h3>To Block an IP address</h3>
<ol>
<li>In the WordPress Dashboard, go to “Settings…Discuss”</li>
<li>To block all or part of an IP address, add it on its own line to “Comments Blacklist”</li>
<li>To block all or part of an e-mail address, add it on its own line to “Comments Blacklist”</li>
<li>Click “Save”<br />
(For more details, see Examples)</li>
</ol>


JP User Registration Blacklist

Prevent User Registration Spam, and Track New User IP address

tornevall

<p>Tornevall Networks DNSBL and FraudBL protection for WordPress. The plugin helps block comment activity, account registrations and other unwanted submissions from addresses flagged by Tornevall Networks DNSBL and FraudBL.</p>
<p>FraudBL is part of the protection layer used by the plugin and is available at <a href="https://www.fraudbl.org/" rel="nofollow ugc">fraudbl.org</a>. For general discovery, broader search terms like fraud, blacklist, comment spam and user registration are usually easier to find than niche technical acronyms alone.</p>
<p>The plugin is intended to provide a lightweight anti-spam and anti-abuse layer for WordPress, with support for local caching to reduce repeated lookups and unnecessary load against blacklist services.</p>
<p>Current admin features include manual DNS lookup tools, self-check tools, visitor statistics, safe IP whitelisting, frontend dry-run support for administrators, Cloudflare Turnstile for comments, DNSBL plus Turnstile protection for new WordPress account registrations, and a separate opt-in Turnstile toggle for the public delisting/removal flow. Tools integration now uses one visible DNSBL / Tools API token field in the plugin UI. The live <strong>Check token permissions</strong> flow always asks Tools directly, warns clearly when the token exists on the other Tools environment (<code>tools.tornevall.com</code> vs <code>tools.tornevall.net</code>), and reports the effective DNSBL permissions for the configured token. Active admin-owned Tools tokens are shown as having automatic DNSBL access through the same <code>X-Dnsbl-Token</code> transport. The plugin now also warns on the WordPress dashboard and settings page when the current token cannot perform live delete / delist operations yet, with a direct link to the active Tools access page. The token status area shows current add/delete/update capability instead of only saying that a token exists, and delisting-page controls stay read-only until delete / delist permission has been confirmed. Internal delist slug routing now uses a dedicated rewrite/query-var path and refreshes rewrite rules on activation and slug changes to avoid <code>/delist</code> 404 cases. The managed public delist page now runs as a checker-style IP-only flow (checks listing first, then submits delist), while custom shortcode pages still support the broader permission-aware operations. The plugin also ships a shortcode delisting/removal form (<code>[dnsbl_removal_form]</code>) with AJAX backend proxy and optional API dry-run acknowledgement, plus a built-in primary removal-page template that is only activated when the configured token has live delete permission. Advanced CIDR delist now follows the delegated Tools guardrail <code>delete_min_cidr_prefix</code>, so non-admin tokens can be limited to <code>/25</code>..<code>/32</code>, <code>/26</code>..<code>/32</code>, or <code>/32</code> only instead of always exposing <code>/24</code>. Tools-backed DNSBL write/check calls now also include additive site identity metadata so Tools-side delist audits can show which WordPress site submitted the request. The admin UI also now shows a small dismissible reminder with a direct link to the WordPress.org review form.</p>
<p>Report issues and feedback: <a href="https://github.com/Tornevall/tornevall-wp-dnsbl/issues" rel="nofollow ugc">GitHub issues</a><br />
Plugin URL: <a href="https://wordpress.org/plugins/tornevall-networks-dnsbl-implementation/" rel="ugc">WordPress.org plugin page</a><br />
Documentation: <a href="https://tools.tornevall.net/docs/dnsbl-api" rel="nofollow ugc">DNSBL API documentation</a></p>
<h4>Support and feedback</h4>
<p>Bug reports and feedback can currently be submitted via <a href="https://github.com/Tornevall/tornevall-wp-dnsbl/issues" rel="nofollow ugc">GitHub issues</a>.</p>
<p>Full Documentation: <a href="https://tools.tornevall.net/docs/dnsbl-api" rel="nofollow ugc">DNSBL API documentation</a></p>
<p>Translations can be contributed via <a href="https://translate.wordpress.org/projects/wp-plugins/tornevall-networks-dnsbl-implementation" rel="nofollow ugc">translate.wordpress.org</a>.</p>


Tornevall Networks DNSBL Implementation

Tornevall Networks DNSBL implementation with FraudBL support for WordPress

JP User Registration Blacklist vs Tornevall Networks DNSBL Implementation