About a year ago we established a phpbb-forum on a national website. It became a huge succes - but now we are being hacked all the time.
How do you secure the Modified forum from being hacked? You guys have been up and running for so long.
I have tried to upgrade the phpbb-version (from 2.0.11 to 2.0.18) but I can't even upload an older version back-up. Whatever I do the forum is still hacked....
Don't know if anyone has any experience with this sort of problems...?
On Christmas day, another forum I'm in got hacked. The admin was too lazy to patch some things up, but he certinaly did afterwards. The admin also backs everything up once a week, so if the whole site got deleted, only a weeks worth of post would be deleted.
A friend of mine partially fixed the problem. What I need to do now is question our webhotel if they keep a back-up of the MySQL-database because the hacker-bastards deleted all the posts..
Anyway thanks to some nice people there is some hope. At least I know now that it is important to use an updated version of the phpbb.
So if we can't get all the posts back, I'll build a new forum - AND KEEP IT UPDATED..
OK, all the posts were gone but we have acceptet our loss.
Now the problem is that what seems to be robots keep generating profiles. They typically refer to som eporn-website and it pisses me off. It's like 4-5 a day!!!!
My cry for help goes: How do everyone else secure their forums from these robots?
If you're running a newer version of phpBB 2.0.10ish or higher (I believe), then you can turn on "Account Activation" which cuts down the number of bots way down.
I think the forum is set to "Account Activation". I'm running 2.0.19 and you have to confirm an email to activate an account..
What i dont understadn is that everytime one of those pricks make an account I get an email with some sort of failure notice. These emails indicate that the email stated in profile is nonexisting but how then can they make a profile.
Can you make a profile and not activate it? and will it still be visible on the forum?
Yeah, I believe you can make a profile with a bad email address ( and not activate it ). They won't be able to log in, and the profile won't be visible in the forum.
