Bots are still getting through site

[Jaz_Sanchez]

bots are still getting through site even with I’m under attack mode on

[Greenreader9]

Then maybe they are real people. Why don’t you check and see what Cloudflare has to say about it in your dashboard?

[Jaz_Sanchez]

there isn’t supposed to be more than 74 ppl registered. rn there is 171

I can tell if there are bots or not from if they have an ava/profile picture

[Oxy]

I don’t think there’s any need to put the whole domain under attack mode

If spam is your problem then you need to make some extra challenge at this address
https://www.degenerate-life.cf/register/

Put the captcha inside that form

how? use plugin ReCaptcha Integration for WordPress – WordPress plugin | WordPress.org

Additionally, on Cloudflare - you can add a Firewall Rule with JS Challenge or a Page Rule with “I’m Under Attack” mode for the registration page.

example for path for page rule: *degenerate-life.cf/register*

[Jaz_Sanchez]

you can add a Firewall Rule with JS Challenge

how can I do that?

[Greenreader9]

Under WAF

[Jaz_Sanchez]

what does WAF stand for?

[wackyblackie]

Web Application Firewall, under the Security tab.

[Oxy]

To really reduce spam your protection must be layered - there is no single magical act.
If someone breaks the first layer of protection, he is greeted by the second, then the third, and so on.

Smart spam know how to solve the captcha and also supports JS
so don’t just rely on those two.

You can simply add in your form
a field that requires… the user who wants to register
that he must write your domain address in a certain field
and then of course you need to check that entry when someone presses the register button and then either passes or doesn’t pass

It’s kind of like asking him 5 + 5 =? only more complex

You can have some picture of an animal in the form
and ask what is in the picture and that the user, among other things, must enter the name of the animal…

Be sure to do something listed here

How to protect your website that is on Cloudflare plus Logs

How to protect your website that is on Cloudflare ? (Last update Apr. 9. 2023.) Don’t expect that if you just set up the CF nameservers everything will be well. Cloudflare is a tool, that you need to understand, learn and put to work for you after proper configuration. We often have the opportunity here on the forum to see that some websites have been suspended for exceeding the limit and mostly this is caused by a bunch of bots doing a vulnerability scan and searching sensitive direct…

[Jaz_Sanchez]

don’t have the money for premium

[Admin]

You don’t need premium hosting, or any paid service. ReCaptcha is a free service that you can use with a free WordPress plugin. Cloudflare’s “I’m under attack” mode is also free, and so is the Page Rules feature that allows you to enable Under Attack mode only on login/registration pages.