Block or flag HumHub sign-ups from untrusted countries
Spam accounts often come from countries where none of your members live. Advanced Registration looks up the country each new account was created from and, outside the countries you trust, alerts the people you choose or disables the account until someone reviews it.
1. List the trusted countries
In the settings of the module (Administration → Modules → Advanced Registration → Configure), open Email alert if untrusted country and pick your members' countries in Trusted countries.
Every country not in the list is untrusted, so an empty list makes every sign-up untrusted. Fill the list before switching on either action below.
2. Choose what happens
Two options, which can be combined:
- If the new account is created from an untrusted country, disable the account: the account is deactivated right after it is created and the person is logged out. They cannot sign in until an administrator enables the account in Administration → Users.
- Send an email alert if a user creates an account from an untrusted country: the members you pick in Users receiving the email alert get an email with the account's name and country, and a Review this account button that opens it in the user administration. When the account was also disabled, the email says so and asks to enable it again if it is legitimate.
The alert is sent in each recipient's language. A recipient whose account is disabled receives nothing.
3. How the country is found
The country comes from the visitor's IP address, looked up in a geolocation database shipped inside the module: no address is sent to an outside service. A visitor on a VPN shows the country of the VPN's exit, so a legitimate member can be flagged; that is what the review button is for.
4. Behind a proxy or Cloudflare
When your community sits behind a reverse proxy, the server sees the proxy's address, the same for every visitor, unless the proxy is declared. The Visitor IP address section of the settings does that:
- The site is served through the Cloudflare proxy: tick it only if your domain's traffic really goes through Cloudflare's proxy. The settings page shows a warning when it detects Cloudflare and the box is not ticked.
- Other trusted reverse proxies: one IP address or range per line (for example
10.0.0.0/8), for a load balancer, a Cloudflare Tunnel or another proxy that passes the visitor's address in theX-Forwarded-Forheader.
Declare only proxies you run or use: a declared address is trusted to tell the visitor's real address, and a wrong entry lets anyone pretend to come from anywhere.
Read next: the page after sign-up.