How to add this new anti bot sign-up configuration on Cloudron?

[jdaviescoates]

I'm getting loads of spam sign-ups to my Ghost sites, but according to this post:

Self-hosters can apply the same blocklist to their Ghost sites, by adding a list of blocked email domains to their config, under spam.blocked_email_domains. For example:

"spam": {
"blocked_email_domains": ["tmomail.net", "txt.bell.ca"]
}

https://forum.ghost.org/t/an-uptick-of-bots-signing-up/54589/4

I tried add that to my env file via the File Manager, with and without export in front of it, but then the app wouldn't start

e.g.

/app/data/env: line 6: export: spam:': not a valid identifier`

How do we add this config on Cloudron please? Thanks!

[nebulon]

You have to set this in the .json config file of your Ghost instance. This is a toplevel property: https://github.com/TryGhost/Ghost/blob/main/ghost/core/core/shared/config/defaults.json#L64

Our blog also seems to be hit by those domains, I have also put them in the blocklist, so lets see.

After changing, make sure to restart the app!

[bmann]

@nebulon is that /app/data/config.production.json or somewhere else?

[nebulon]

Yes, that is the config file where the section should be added.

[jdaviescoates]

Just to add, this is how I've now got it seemingly working at the end of my /app/data/config.production.json:

  },
  "privacy": {
    "useUpdateCheck": false,
    "useGravatar": false,
    "useRpcPing": false,
    "useStructuredData": true
  },
  "spam": {
    "blocked_email_domains": [
      "tmomail.net",
      "txt.bell.ca"
    ]
  }
}

i.e. you can't just copy/ paste the code in, you also need to add that preceeding comma , or it errors out.

[bmann]

Thanks! yeah, that's JSON validation. Applied, appreciate the feedback.

[bmann]

Hmm. Found another domain email.uscc.net

[rosano]

Ghost recently made a UI for this https://ghost.org/changelog/signup-spam-protection/