How to stop forum spam before it starts

Think in layers

No single setting stops all spam. What works is several cheap barriers, each catching what the last one missed:

1. At registration: make automated signups fail.
2. After registration: make new accounts earn trust before they can do damage.
3. After posting: make spam quick to find and remove.

Layer 1: registration

• Email verification. The new member must click a link before the account works. It stops a lot of throwaway signups and confirms your forum email works.
• Question-based verification. Ask something anyone in your community knows but a bot doesn’t: “Which town is our club based in?”, “How many strings does a standard bass guitar have?” or simply “Type the name of this forum”. phpBB has the Q&A plugin, MyBB has Security Questions and SMF has verification questions. Change the questions if spam starts getting through.
• A CAPTCHA as well, such as the built-in image CAPTCHA or reCAPTCHA/hCaptcha where supported.
• A shared spammer database. MyBB has built-in StopForumSpam checks; add-ons can add similar checks to phpBB and SMF.
• Admin approval, for small or private communities, means you see every signup.

Layer 2: new members earn trust

• Moderate first posts. A new member’s first few posts wait for approval. It costs you a minute a day and stops almost all human spammers. phpBB can do this through the Newly Registered Users group; SMF with post moderation and group permissions; MyBB through group permissions and Group Promotions, or a plugin.
• No links or signatures at first. Spam exists to place links. Remove signature and link permissions until members have a few posts.
• Limit private messages for new accounts, so spammers can’t message your whole member list.
• Promote automatically. After three to five approved posts, members move to the normal group. phpBB does this with the new member post limit; MyBB with Group Promotions; SMF with post-count groups.

The settings, package by package

Step-by-step: phpBB, MyBB, SMF.

Layer 3: finding and removing spam fast

• Check the approval queue daily while the forum is new.
• Let members report posts. All three packages have a report button; make sure reports reach an email you read.
• Delete, don’t just ban. Remove the account and everything it posted, so spam links don’t stay live for search engines.
• If spam gets through, change your questions. It usually means a question has been learned or is too easy.

Don’t forget the rest of the site

Contact forms, guest posting and profile fields are also targets. Keep guest posting off unless you really need it, and check that nothing on the forum lets unregistered visitors post links. And protect the accounts that could undo all of this: securing admin accounts.