Support

Admin Tools

#41831 Use wildcards in forbidden username setting

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
4.4.13
PHP version
8.3.19
Admin Tools version
Latest

Latest post by nicholas on Monday, 14 April 2025 02:14 CDT

webgobe

Lately my site has been hit by a large number of fake registrations, using usernames like this:

Тест-драйв без оплаты: https://hideuri.com/2Qrl4Q

Тест-драйв без оплаты: https://hideuri.com/1WnQL7

I am not sure, if I can add on the forbidden usernames settings something like:

Тест-*

to stop these registrations. The above is just one example, I have many similar situations I would like to stop happening. Captchas don't really help there, the forbidden username feature would be fantastic if could be used in the above way.

nicholas
Akeeba Staff
Manager

This feature only does exact matching. It's not meant to be used for your use case. The intended use case is "reserving" usernames you want to keep for your own use, or which may be confusing to your visitors. For example, when you run a site with a support help desk (like ours) you do NOT want someone to subscribe as the name of the company, or as "helpdesk", "support", or something similar. The secondary use case is to forbid very offensive usernames, such as those pertaining to, uh, copulation with one's mother. I'll let your imagination fill in the gaps.

When you want to block patterns of usernames we have two existing features, WAF Deny List and Anti-spam Bad Words. Since these usernames are always followed by a dash or any other non-word character AND the word they use is definitely not something any regular visitors to your site would legitimately use you can and should use the Anti-spam Bad Words filtering feature. Adding Тест to the bad words would block the user creation forms with these usernames from being submitted.

IMPORTANT! This will not stop user creation through means that go outside of an interactive Joomla session, e.g. registering a user account with a social media login, or via an API. However, these are rather exotic use cases for the kind of problem you have and should not be an issue (which is to say, you'd have to explicitly configure something like that, in which case you'd know what's going on and how to deal with it).

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

webgobe

Thank you!

The goal is to reduce the chances of have these spam registrations, and whatever works, is useful for me!

nicholas
Akeeba Staff
Manager

You're welcome!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Easter vacation: We will be closed from 17 April 2025 16:00 UTC to 21 April 2025 06:00 UTC due to observing the Christian Easter holiday. Support will be closed during that time for both new tickets, and replies to existing tickets.

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!