Mother May I

Overview

Most Drupal sites that allow user login are plagued by account requests from abusers and bots whose only intent is to post content to the site for nefarious purposes. While Drupal supplies tools that are effective at keeping them out (Captcha, for example, and administration approval of new accounts), there's still some level of overhead for administrators.

Mother May I provides a simple to use extra hurdle to reduce the bother of spamming account requests. It's primarily useful to sites with a limited target audience (at least for authenticated accounts) where valid users have some side information about the group. The site administrator can define a site-specific "secret word." Anyone requesting an account must enter the secret word before even a temporary account is created.

It's highly recommended that sites not depend solely on Mother May I to vet account requests, but this is an easy way to block spam requests from abusers that manage to get past the existing filters.

Features

The site administrator specifies a secret word. A user requesting a new account must enter the secret word before account creation can proceed.

The administrator can also enter a "hint" block. The hint should be descriptive enough that a valid site user (for example, a member of the organization) can easily figure out the word from the hint, but someone outside the organization cannot. It's up to the administrator to decide how cryptic s/he wants to be.

If no secret word is defined, Mother May I doesn't impact the account request process.

Mother May I logs any account requests with incorrect secret words, or with the "empty field" not empty, even if the request was blocked by something else like Captcha. You can see the results in your site activity log.

Known Issues

• I know you could probably do something similar to this using Rules, but this is easy to install and maintain.
• It might be nice to support blocking other "unauthenticated" entries into the system, such as contact forms. Maybe someday.

Administration and Use

On the Mother May I administration screen, you can set the following:

• The secret word. This needs to be alphanumeric. If no secret word is specified, the users requesting accounts won't be asked for one. (Or, see Secret Word as Regular Expression below.)
• The password hint. If entered, this text will be displayed above the secret word entry box on the account register page.
• Password hint filter. This says what kind of filtering (HTML, etc.) to use when displaying the hint.
• Form weight. The default should be fine, but this lets you move the "secret word" block up and down in the account registration form.
• A check box to enable a "this field must be left blank" field, plus a prompt to display to the user with it.

If a secret word and optional hint are supplied, users will see a required "Enter the secret word" box on the account request page.

Secret Word as Regular Expression

You can specify the secret word as a regular expression or just a word to match. There are two options:

• Just give an alphanumeric string. The user must enter that string exactly as entered, including matching case. "Smith" will not match "smith."
• Set the checkbox and you can enter a regular expression match pattern in the form used by php's preg_match().

Using a regular expression gives you a lot of control over what can be entered, though it's up to you to get the expression right. Best to read the php documentation. Here are a few simple examples:

/word/

Match the word 'word' anywhere in the input field. Must be lower case.

/word/i

Match the word 'word' anywhere in the input, case insensitive.

/^word/

Match 'word' only at the beginning of the field, case sensitive.

/^(foo|bar)$/i

Match either the word 'foo' or 'bar' exactly in the field, case insensitive.

/^[Ff]red$/

Match either 'Fred' or 'fred,' but not 'FRED,' 'Freddy' or 'manfred.'

Note that, with regular expressions, you can be pretty flexible with your answers. For example, you could have a hint like Enter a New England State, and then specify /^(connecticut|massachussets|rhode island|vermont|new hampsire|maine)/i as the required answer.

Back Story

I have a rather small website, primarily intended for the members of a local organization. The site should be visible to all (it also serves as a recruiting tool), but user accounts are restricted to members of the organization or well known "friends."

Unfortunately, we suffer from a fairly constant flood of spammers trying to create accounts on the site. (Xrumer, anyone?) Something will get past the capcha and create an account. The account isn't worth anything because no privileges are granted until an administrator enables the account. But the administrator keeps being bothered dealing with with the bogus accounts.

I keep adding access rules to block large ranges of IPs (nobody in China or the former USSR has a legitimate interest in our website), but the list is getting unmanageable.

Hence "Mother May I." This module adds a settings screen that allows the administrator to define a site-wide password plus a hint. Typically, the password should be something that anyone in the organization will know, but not someone outside the organization. (In particular, it shouldn't be something publicly available on the site.)

A "Type the secret word" box plus the hint are added to the user/register screen. If the box isn't filled in correctly, the request is rejected, and the administrator isn't bothered.

Efficacy confirmed!

The first confirmed spammer blocks this morning, Oct 10, 2012, now that logging has been added! These must have been humans since they got past Captcha and followed the instructions to not fill in the blank field. But the secret word was something totally random. Take that 86.10.128.199 and 31.184.238.33. Go back and live under your rocks where you belong!

However, I do notice that the "leave this blank" field isn't equally as effective. It appears that both humans and bots are, in fact, leaving it blank. Oh well, it was worth a try. Maybe if it was a "password" field?

Something I've noticed, though, watching the logs on my site of blocked registration attempts... It may just be the current round of popular bots, but most of the failed attempts, even the ones that get past Captcha, put either nothing or a bunch of random characters into the challenge field. I suspect that even if the challenge hint was something like "Type A1B2C3 into this field," most if not all current bots wouldn't get through. And if you added "but reverse the order of characters," they'd be totally stymied.

In other words, until bots get much smarter, this module should be able to block bots even with a very obvious challenge that any human could figure out. As it is, I haven't had to deal with a single spammer registration attempt since installing this. I hope you find it useful, too.