Tilspire 1.17.3

tilspire 1.17.3 keeps bots off the sign-up form, and clears away the accounts they leave behind.

Bots stopped at the form #

Until now the sign-up form only limited how often one address could sign up, so bots spread over many addresses got straight through. It now also carries a hidden field a person never sees, and checks how soon the form comes back. Once you add reCAPTCHA keys under System ▸ Settings ▸ Security, Google's "I'm not a robot" box is checked on your server as well. A refused sign-up keeps what was typed, apart from the passwords.

Unconfirmed accounts removed #

A bot that does get through never confirms its email address. tilspire can now remove member accounts left unconfirmed for a number of days, 7 by default: only ones that never signed in and have written nothing, and never staff.

Worth knowing when you update #

• Removing unconfirmed accounts is on for new sites. On a site that updates it stays off until you switch it on under System ▸ Settings ▸ Security.
• Health has a new check, Sign-up protection, that tells you what is in place.
• If your theme draws its own sign-up form, add $this->signupChecks() inside it. See Themes.

This announcement and the updated documentation were proposed through the Operator API and approved by a person. See the changelog for everything in the release.