PHP 电子邮件激活 - 如何避免滥用者？
如何避免滥用需要电子邮件激活的帐户系统？滥用者基本上可以劫持您的帐户激活系统，向某人（或多个人）的电子邮件发送垃圾邮件。
最明显的解决方案可能是设置每小时或每天最多 X 个提醒的限制。但是：这并没有给非滥用用户带来好处——例如，如果他们的邮件服务器只是遇到了糟糕的一天怎么办？除了设置暴力限制之外，还有更好的解决方案吗？
How do you avoid abusers for account systems requiring email activation? Abusers can basically hijack your account activation system to spam someone's (or multiple someone's) email's.
The most obvious solution is probably to set a limit of X reminders max per hour or per day. But: This doesn't give the non-abusing user the benefit of the doubt - what if their mail server is just having a bad day, for example? Are there better solutions other than just setting a brute-force limit?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
设置每 Y 小时/天 X 次提醒的限制绝对是应该做的事情：
如果 3 封邮件没有送达用户，那么第 4 封邮件送达的可能性非常低......
（2 或 3 封邮件已经相当慷慨了 - 我想说每天 1 封邮件就足够了，几乎在任何可能的情况下）
Setting a limit of X reminders per Y hours/days is definitely something that should be done :
If 3 mails don't make it to the user, chances are pretty low that a 4th one will...
(And 2 or 3 mails is already pretty generous -- I would say 1 mail per day is enough, in almost any possible situation)
据推测，他们实际上不能将自己的内容放入此类电子邮件中？因为这只是一封自动激活电子邮件？这应该意味着，除了“一般的滋扰”之外，人们实际上没有任何动机去滥用它，就像他们可以发送垃圾邮件一样，对吗？
洪水控制——即限制每个IP地址每小时的注册尝试次数——可能是限制麻烦制造者的好方法。之后，找出所有连续犯罪者并阻止他们的 IP 地址。
除了设置限制之外，您还可以进行更多次数的“宽限”尝试，这样限制在经过此次数的宽限尝试之后才适用。
例如，每个 IP 地址每天 5 次可能是限制，但只有在某人一天超过 20 次之后才应用此限制。根据您认为是否“异常”使用来调整数字。
Presumably, they can't actually put their own content in such emails though? Because it's just an automated activation email? This should mean that apart from just 'general nuisance', there isn't really any incentive for people to abuse it as there would be if they could spam, right?
Flood control - that is, limiting the number of sign-up attempts per IP address per hour - is probably a good way to limit the troublemakers. After that, identify any serial offenders and block their IP address.
As well as just having a limit, you can have a more generous number of 'grace' attempts such that the limit doesn't apply until after this number of grace attempts.
For example, 5 per day per IP address can be the limit, but only apply this limit after someone does more than 20 in a day. Adjust the numbers based on what you think is/isn't "abnormal" usage.