ShieldPRO 8.6 came with a brand new feature to detect, and allow you to then block, spammy user registrations based on their email addresses.
This feature is completely separate to our bot-protection features that detect bots on your site attempting to register users automatically.
The newer feature is designed to capture spam users who are signing up with fake, non-existent, or disposable email addresses.
It works by examing the domain name of the email address to see how it’s configured, as it related to Email.
The original tests included:
- Does the domain name resolve to an IP address?
- Does the email have an MX record? (i.e. can it actually receive email)
- Is the domain a “known” disposable email address?
This was a great start to this work, but there was always going to be room for improvement.
Areas For Improving The SPAM User Registrations Feature
The first area of improvement was decoupling all the different tests. In the 1st version, each test relied on the success result of the previous test.
So for example, we didn’t just test MX records (2), we tested whether the domain resolved (1) and if it didn’t have an IP address we didn’t even perform the MX checking.
This was based on the assumption that if the domain didn’t resolve, then there wouldn’t be MX records.
This assumption was false, but we knew this and accepted this limitation going into the 1st version of the feature as it would apply to 99.99% of cases.
Based on some feedback, we’ve decided to release these dependencies between tests, and we’ve adjusted the tests to be more granular.
There are now 5 tests:
- Is the email structure valid? i.e. does it “look” like a valid email: i.e. [email protected]
- Is the domain of the email address a registered domain name?
- Does the domain resolve to an IP address?
- Are there MX records for the domain
- Is the email address a disposable domain?
So you can see we’ve split up the original “domain” test into 2 parts of whether the domain is actually registered, and does it have an IP.
Each of these options are completely independent, except for Option 1. Option 1 must be verified before attempting any of the other tests.
The 1 Drawback To More Tests
As you might imagine, more tests means more time taken to complete the tests. There’s no way around that.
We feel however that for the feature to be useful, these tests are required.
Remember, the tests aren’t 100% – there’s no way to know all possible disposable email domains, so some will fall through the cracks.
Also, whether a domain is registered is up to each domain registrar to provide the information accurately. We just report on what they say.
If you’re unsure, always set the system to log these events first and assess the results – the Audit Trial will always tell you what’s happening.
As always we welcome feedback on this feature and any others. The best way to know if our system is working is when you report how it works for you and if you see any issues or room for improvement.
These updated email tests are available with ShieldPRO 9.0.3.
All the security options you can imagine + setup is really simple & easy, you don´t need to be expert to secure your website from all the bad internet things. Yes, and it´s FREE! I would suggest to display the firewall badge on your website – it gives visitors confidence…
Good Security Plugin
The plugin is very good and offers lots of features, which were missing on some other commonly used plugins. I like CSP and other features in this plugin, which is the main reason for me, to switch to this plugin. Very helpful for someone intrested to implement security headers information,…
Hands down the best security plugin
It is not perfect, but it is hands down the best security plugin from its implementation standpoint, and affordability.
Works beautifully out of the box.
I use this on multiple sites for my friends and family and it works, I don’t have a need to change most of the settings so there’s far more to customise should one want to, but the “out of the box” option works great for simple sites.