June 4, 2020 by Paul G. | Blog, Features, Shield Pro, Updates

Improvements to SPAM User Email Detection

Shield Security Logo

ShieldPRO 8.6 came with a brand new feature to detect, and allow you to then block, spammy user registrations based on their email addresses.

This feature is completely separate to our bot-protection features that detect bots on your site attempting to register users automatically.

The newer feature is designed to capture spam users who are signing up with fake, non-existent, or disposable email addresses.

It works by examing the domain name of the email address to see how it’s configured, as it related to Email.

The original tests included:

  1. Does the domain name resolve to an IP address?
  2. Does the email have an MX record? (i.e. can it actually receive email)
  3. Is the domain a “known” disposable email address?

This was a great start to this work, but there was always going to be room for improvement.

Areas For Improving The SPAM User Registrations Feature

The first area of improvement was decoupling all the different tests. In the 1st version, each test relied on the success result of the previous test.

So for example, we didn’t just test MX records (2), we tested whether the domain resolved (1) and if it didn’t have an IP address we didn’t even perform the MX checking.

This was based on the assumption that if the domain didn’t resolve, then there wouldn’t be MX records.

This assumption was false, but we knew this and accepted this limitation going into the 1st version of the feature as it would apply to 99.99% of cases.

Based on some feedback, we’ve decided to release these dependencies between tests, and we’ve adjusted the tests to be more granular.

There are now 5 tests:

  1. Is the email structure valid? i.e. does it “look” like a valid email: i.e. [email protected]
  2. Is the domain of the email address a registered domain name?
  3. Does the domain resolve to an IP address?
  4. Are there MX records for the domain
  5. Is the email address a disposable domain?

So you can see we’ve split up the original “domain” test into 2 parts of whether the domain is actually registered, and does it have an IP.

Each of these options are completely independent, except for Option 1. Option 1 must be verified before attempting any of the other tests.

The 1 Drawback To More Tests

As you might imagine, more tests means more time taken to complete the tests. There’s no way around that.

We feel however that for the feature to be useful, these tests are required.

Remember, the tests aren’t 100% – there’s no way to know all possible disposable email domains, so some will fall through the cracks.

Also, whether a domain is registered is up to each domain registrar to provide the information accurately. We just report on what they say.

If you’re unsure, always set the system to log these events first and assess the results – the Activity Log will always tell you what’s happening.

Feedback Welcome

As always we welcome feedback on this feature and any others. The best way to know if our system is working is when you report how it works for you and if you see any issues or room for improvement.

These updated email tests are available with ShieldPRO 9.0.3.

Hello dear reader!

If you want to level-up your WordPress security with ShieldPRO, click to get started today. (risk-free, with our no-quibble 14-day satisfaction promise!)

You'll get all PRO features, including AI Malware Scanning, WP Config File Protection, Plugin and Theme File Guard, import/export, exclusive customer support, and much, much more.

We'd be honoured to have you as a member, and look forward to serving you during your journey towards powerful, WordPress security.

Try ShieldPRO Today →

ShieldPRO Testimonials
@b2marketing's Gravatar @b2marketing

Works like a oiled machine!

I have not had a problem with this and stops hackers like nothing else. Easy to use and relative lightweight and support and documentation is great. Highly recommended!!

@hcurry84's Gravatar @hcurry84

the shield

the shield is awesome

@smartvox's Gravatar @smartvox

Improves security

It has a lot of different options. Hard to know which are useful vs. which are obscure, but I feel a lot happier having Shield WordPress Security in place. It’s done no harm that I know of and I’m sure has done good.

@simonlampen's Gravatar @simonlampen

Great Plugin

Thanks team, you have a great plugin there. It has radically improved out site security and reduced pesky attack attempts. Well done!

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese