Administration

Anti-spam

Screen new registrations against the StopForumSpam database — opt-in, privacy-minimised, fail-open.

What it does

Open registration attracts drive-by ad bots — scripts that create an account, post a link, and move on. Tyto can optionally screen every new registration’s IP address against StopForumSpam, a shared, free database of addresses seen spamming other sites. A hit above your confidence threshold refuses the registration before the account exists.

The check is off by default. Tyto never calls out to a third-party service unless you turn it on — a server run entirely offline from other services stays that way until you opt in.

Enabling it

1. Open the Moderation tab

   Admin → Settings → Moderation → Anti-spam registration check.

2. Turn it on

   Flip ipReputationEnabled, then tune the rest of the section to taste.

3. Save

   Changes apply immediately — no restart, no deploy.

What gets sent

The check is a POST-only query — StopForumSpam does not content-log POST bodies the way it does GET query strings, so this is the more private of the two ways to call their API. Each request sends:

• the registrant’s IP address
• an MD5 hash of the lowercased email address — the raw email never leaves your server
• the username, only if ipReputationCheckUsername is on

A verdict is cached in Redis for 24 hours, keyed on the IP + email pair — the same IP retrying with a different email still triggers a fresh query, but a repeat attempt with the same IP and email is served from cache.

If StopForumSpam is slow or unreachable, the check fails open — registration proceeds. A third party’s outage should never lock out your own users. A flagged registration gets a generic 422, “Registration could not be completed.”, plus a “contact X” line when you’ve set an appeal contact.

Allowlist syntax

One entry per line in ipReputationAllowlist, # starts a comment:

# internal + trusted contacts skip the check entirely
admin@example.com
@partner-org.com
203.0.113.42
198.51.100.0/24

Four forms: a full email, an @domain.com (matches any address at that domain), a single IP, or a CIDR range. Matching entries skip the StopForumSpam query entirely — they’re never sent, not even checked and allowed.

Two ways to get someone through a wrongful refusal: add them to the allowlist, or have an admin provision the account directly — invited and admin-provisioned accounts bypass the check altogether, since they never went through open self-registration.

GDPR

Enabling the check means telling registrants about it. Add a paragraph like this to your privacy policy — legalContactEmail is a reasonable value to drop in for “your contact address”:

During account registration we check your IP address and a one-way hash
of your email address against StopForumSpam (stopforumspam.com), a
third-party anti-spam database, to prevent automated abuse. Legal basis:
legitimate interest (Art. 6(1)(f) GDPR — fraud and spam prevention).
StopForumSpam retains query logs for up to 5 days. If your registration
is refused in error, contact <your contact address>.

If you’ve turned on Also check the chosen username (ipReputationCheckUsername), extend the paragraph to say your chosen username is checked too — the pasted text above only covers the default configuration.