Random subscribers added to self-hosted newsletter en masse. How do I
stop?
reddit / selfhosted

----------------------------------------------------------------------
chriscasemart · 2023-10-16 13:23

I run the newsletter for my website on a self-hosted installation of
PHPList.

Sometime in the last couple weeks, I started getting 20x the number of
subscribers--most of which bounce and none of which open/click emails.

As context, the site has an opt-in form and PHP generates another opt-
in form.

But, I'm getting these subs even when both opt-in forms are disabled.

Here's what I've tried to rectify the issue:

\*I've restored a back-up of the server from two weeks before the
problem began

\*I've updated PHPlist to the current version

Neither solved the problem.

Two questions:

\*Am I right to think--if these subs aren't going through the opt-in
pages--they are being added directly to the database? Or is there some
other option?

\*What else should I try to keep these subs from being added?

Thanks!

​

----------------------------------------------------------------------
atika · 2023-10-16 13:39

I don't think they are added directly to the db, however they are bots
for certain. One way to find out, is to disable the subscribe page and
see if there are new subscriptions.

If not, look into anti-bot measures for PHPList. I'm not familiar with
it.

----------------------------------------------------------------------
chriscasemart · 2023-10-16 13:51

I'm getting these subs even when the subscribe pages are disabled.

PHPList has a bot plugin, but it appears to block IPS and the subs are
all from different IPs.

Any other suggestions?

----------------------------------------------------------------------
atika · 2023-10-16 13:55

IP blocking hasn't worked in the last decade or so.

Is your db exposed to the internet?

----------------------------------------------------------------------
chriscasemart · 2023-10-16 14:59

Thanks for this.

I've just changed my DB password to see if that's the issue.

How would I check to see if it's exposed to the Internet?