Flooding/Spamming/Banning on forums

@Instability described repeated flooding from rapidly created alternate accounts, and @Dani pointed out that single checks are easy to evade. A layered, evidence-driven approach works best: combine low-friction front-line defenses, behavior/rate controls, and stronger escalation only for accounts that keep returning.

Start with low-friction barriers you can deploy quickly:

• Use a CDN/WAF that can present JS challenges and adaptive rate limits to suspicious traffic. This drops most automated attackers before they hit your app (Cloudflare rate limiting).
• Add a simple invisible-honeypot field and require basic JS execution for posting; bots that auto-fill hidden fields or do not run JS will self-identify.
• Apply short-term rate limits (per-account, per-session, and per-source fingerprint) so a flood becomes ineffective rather than outright blocking legitimate users. Example NGINX snippet (tweak values to fit traffic patterns):

limit_req_zone $binary_remote_addr zone=forum:10m rate=30r/m;

server {
  location /post {
    limit_req zone=forum burst=10 nodelay;
  }
}

If abuse continues, add layered detection and escalation:

• Browser/device fingerprinting (e.g., FingerprintJS) and TLS/JA3 fingerprints help tie sessions together even when IPs rotate; use them for scoring, not immediate bans (FingerprintJS, JA3).
• Block or challenge known anonymity/proxy/Tor exit nodes using public lists (Tor exit list) and commercial proxy-detection feeds when necessary.
• Route new accounts or low-trust accounts into a moderation/queue or enforce progressive friction (CAPTCHA, SMS/phone verification) only when behavior looks risky.

Operational tips: log enriched signals (fingerprint, ASN, user-agent, timing patterns), tune thresholds on real traffic, and prefer shadowbanning or throttling over heavy-handed network blocks to avoid collateral damage. Be mindful of privacy and legal tradeoffs when fingerprinting or requiring phone verification.

A pragmatic rollout: enable WAF + honeypot → add rate-limits → enable scoring/fingerprinting → escalate to targeted challenges/phone verification for persistent offenders. This raises attacker cost and typically ends repeated flooding without breaking normal users.