Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a social networking website and I want to ban a user from the website. I've added his IP address to the ban list in the .htacess file and to the php level for banning that user, but he keeps coming back with different IPs.

How can I permanently ban a user, no matter how hard he tries to re-enter the website?

share|improve this question

closed as not constructive by John Gardeniers, Michael Hampton, womble, gWaldo, Ward Aug 22 '12 at 18:09

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Welcome to reality. In essence there is absolutely nothing you can do. No matter what measures you take, they are easily circumvented. This is for the simple fact that you have nothing absolute to identify that user with. Ban the IP address and he will get a new one. Ban the user account and he'll create a new one, etc. – John Gardeniers Aug 22 '12 at 2:01
I had this problem 12 years ago. My solution was simple: I called his mom and she confiscated his modem. Problem solved. – David Schwartz Aug 22 '12 at 2:17
Is this a vBulletin forum by chance? – SpacemanSpiff Aug 22 '12 at 2:22
The more "sophisticated" your means of blocking one user become, the more potential nuisances for many other users you will inadvertently introduce. Make sure the effort is worth this risk – Tobias Kienzler Aug 22 '12 at 14:03
An IP ban might impact other users. Most folks do not have static IPs, so periodically they get reassigned. Blocking my IP will block me until I get a new one, then it could very well block my neighbor when he gets my old IP. What dating site are you trying to protect? – Freiheit Aug 22 '12 at 15:44

I guess you're coming at this from the wrong angle. Many sites (including this one) slowly let you see more of the abilities as you prove you can be trusted.

I'd suggest making first posts have to be moderated, or some form of voting system and then none of his posts will stay visible for long.

This is a human problem really, not so much a technical one.

share|improve this answer

Thanks to Tor and innumerable other proxy services, you can't depend on an IP ban to block a user.

You'd need to implement some kind of other barrier - email validation requirements on sign-up, maybe, or require moderation approval for new account creations? Unless your user sign-up process requires blood samples, social security numbers, and mothers' maiden names, you'll have cracks open for illegitimate accounts.

The choice of what kind of barriers you put in place on the scale of usability versus security is an important decision - keep in mind that for everything you put in place to thwart a small segment of trolls, malicious users, or bots, you'll be inconveniencing a much larger set of legitimate users.

share|improve this answer
i have already the email ban, but he keep on creating free email accounts, and he is impersonating other users.. etc so many problems ... but i have no answer.. – user1179459 Aug 22 '12 at 2:15
@user1179459 Banning free email providers might work. has done this for several years to limit trolls availability to rejoin the site. IF the idiot's impersonating other users, enforcing unique display names/etc would be more effective than trying to ban the troll. – Dan Neely Aug 22 '12 at 12:47

When a new user signs up, use a service like Twilio to send a text message to their phone containing a short passcode. They have to correctly enter this code to verify their account. This is similar to how Craigslist (attempts) to keep spammers out and is also frequently used by online banking as a kind of a poor man's two-factor authentication system.

share|improve this answer

I can't promise you "successfully, permanently" but there are certainly plenty of things you can do to make his life more difficult. Enough of these and he will give up.

You have already tried using his IP address for identification but it's easy to find free proxy servers. It's somewhat harder to find free and anonymous proxy servers. Most proxy servers send the user's IP address along in an X-Forwarded-For: header. You can use mod_security to block these.

SecRule REQUEST_HEADERS:X-Forwarded-For "@Contains"

Obviously, you should replace with his actual IP address. You can block a larger set of proxied IPs by removing the last octet.

This will limit him now to using anonymous proxies and Tor. You can identify when he's using Tor because every request will come from a different IP address and these will probably all be on a Tor exit node list. Here are two examples of lists. There are proxy lists available too.

You can force him to bypass the proxy for just one subrequest by using either Flash or Javascript or even just an image link. This depends on how the proxy is set up in his computer (you can put it into the browser or the OS or have it as a transparent proxy on the network) but whatever type it is, it probably only proxies for port 80 and 443. Have your website cause him to connect on port 8080 or port 25 or something else and encode a unique identifier in the request. This would do the trick in PHP:

echo("<img src=\"".session_id().".jpg\" />");

The next step I would take is using EverCookies. Depending on how good he is at removing all the various storage methods, that alone might be enough to reliably identify him. He can avoid this by running a browser in a VM and reverting it to a known state every time he gets banned again or by not running javascript but you will have successfully made his life that bit more difficult. You could potentially use the fact that he's not running javascript to identify him.

It's also worth noting that Google analytics assign a unique identifier in the second "field" (separated by dots) of their __utma cookie. If you have Google analytics and he doesn't delete this cookie, you may already have enough to track him.

To log cookies (and all HTTP headers) you can use a forensic log.

Following that, browser fingerprinting is a bit more difficult and prone to both false positives (if you make it a little fuzzy) and false negatives (if you go for exact matches only) but can it be done. It would actually be more effective if he keeps reverting his VM to a known state because that will mean his fingerprint never changes. He would have to change his VM's screen resolution and time zone and the installed plugins each time he got banned.

One more method: Identify the content he posts. Just treat him like a normal spammer. Feed his data through a Bayesian learning engine and teach it to recognise him... and once it's good enough at recognising what he posts, ban anyone who posts that sort of content. This one has the nice advantage that false positives are probably people you would want to ban anyway, even if they're not the same guy.

share|improve this answer
Good suggestions here, but the point about "outing" the proxy by use of a nonstandard port request is probably well within the realm of "hurting legitimate users more than hindering malicious ones". That said, for a social networking website it may not make a huge difference as the majority of your users are probably not behind a firewall. – Justin ᚅᚔᚈᚄᚒᚔ Aug 22 '12 at 15:41
@Justinᚅᚔᚈᚄᚒᚔ That idea was more about finding their true back-end IP address rather than detecting that the connecting IP is a proxy. If the back-end IP address is one you have detected earlier as undesirable, you could use that wrong-port request to set a cookie that would allow you to block just a single user behind the proxy. Good point about making sure you are not blocking your real users though. You wouldn't want to shoot yourself in the foot here. – Ladadadada Aug 22 '12 at 16:08

We handle this differently. Along with temporary IP Bans (that are easily circumvented) we have a cookie that identifies him as banned. And if he comes back none the less we have a special usergroup that we will assign to him. He isn't able to notice anything unusual everything looks and works as expected on his side. But all of his actions, posts, PMs and so on are invisible for others.

Eventually he will get bored since no one is reacting to him (how should they if none of is posts is visible except for him)

share|improve this answer
This is called a hellban, and a lot of people consider it unacceptable and effectively fraud. – David Schwartz Aug 22 '12 at 13:17
Yes. But so is re-registering on a Website you have been previously banned. I should may add that I'm from germany where jurisdiction has given Website owners a virtual domestic authority. So re-registering essentially is intrusion but it's rarely really enforced by law. So "hellbanning" as last resort is in turn, if all else fails justified in my eyes. It all boils down to in what legal boundaries you have to act. – genuineparts Aug 22 '12 at 13:37
My own position is this: If you have the administrative discipline to use a hellban only in those exceptionally extreme cases where it really is warranted, then fine. But if your honest assessment of your ability to run your site doesn't convince you that the tool won't be misused, you're much better off not having it. – David Schwartz Aug 22 '12 at 13:51
That's my philosophy too, however the main thing here is that the OP asked for ways to permanently get rid of an user. I merely told him another way, without recommending it especially. :) – genuineparts Aug 22 '12 at 14:10

Depending on how little he knows, you could try saving a "Token of Death" as a cookie. If that cookie is found, serve the banned page. He may not think to check for something like that, particularly if you pick some kind of sneaky name (Maybe something session related?)

share|improve this answer
no way, he is network engineer, he even changes the network isp's even i dont know how he do it.. very stuff guy.. – user1179459 Aug 22 '12 at 11:44
Clear the browser cache and he is back on – Chida Aug 22 '12 at 12:02

Report him to his ISP. Include detailed logs (IPs, actions, timestamps with timezones), copies of your site's administrative policy, and so on. If his ISP is not cooperative, ban his entire ISP. If users complain, tell them that you are very sorry, but they have an ISP that refuses to deal with abuse.

Surprisingly, if you do this correctly and responsibly, most ISPs will cooperate with you. They won't identify the user to you, but they will deal with the user.

If he connects through proxies, ban the proxies.

This may or may not work, but it's about all you have.

share|improve this answer
i don't think reporting to the ISP is a solution that will work, because he is doing it in my website, and ISP will say its your problem, he hasn't done anything wrong basically to them, and creating a impersonating accounts,money scams,treating and verbally accusing members i don't think ISP will care.. – user1179459 Aug 22 '12 at 11:47
So that means you didn't try it. I have tried it many times, and I can tell you from personal experience, it works. And, like I said, if it doesn't work, ban his entire ISP and explain why. See what the ISP does when their customers start complaining. – David Schwartz Aug 22 '12 at 12:57

You can't, really.

My first suggestion, is if you have his original IP logged, to report him to his ISP for abuse, and try to get his service yanked, or suspended. This will vary based on the ISP, but they can be very helpful. Failing that...

You can use cookies, Flash cookies or browser fingerprinting to try to remember him no matter his IP, but those are fairly easy to bypass. A more advanced, but equally easy to bypass ban (provided he knows what to look for) is to capture his MAC address and ban that.

You also might want to look into banning the IPs of free, publicly available proxy servers and prohibit signing up with a list of known free webmail providers to cut down on his options, but even then, a cheap account with a VPN provider and/or an obscure webmail provider can bypass those.

Doing all of the above is somewhat effective, but a determined troll will get through those blocks, and in my experience, the only thing that really works is moderating new user sign ups, and that causes issues with driving off legitimate new users. You could just keep banning him until he tires and finds something else to capture his interest (like a shiny object).

If he's truly that big a problem, you can use cookies and/or browser fingerprinting to ID him, and redirect him to a copy of the site that only he can see or make his posts and activities only readable to him - so he can troll away until he gets bored, thinking he's bypassing the ban, but in actuality, you've created a private little sandbox just for him, and no one else is impacted by his crap. I've done that in the past with some more troublesome forum trolls, but unless they're really, really persistent and really, really vile, it's more effort than it's worth, IMHO.

share|improve this answer
Good theory but in many (most?) countries an ISP which removes a client's access based on nothing more than an allegation subjects itself to legal action, as many have learned the hard way. – John Gardeniers Aug 22 '12 at 2:59
@JohnGardeniers Someone should tell the MPAA and RIAA that, huh? Or the European governments with various "3 strikes" laws, and so on. – HopelessN00b Aug 22 '12 at 3:01
The MPAA and RIAA already know it. Actions be taken those governments are a completely different issue and still require evidence. – John Gardeniers Aug 22 '12 at 3:04
How are you going to capture his MAC address? If he's close enough for you to be able to get his MAC, you can just go and punch him in the nose. – womble Aug 22 '12 at 9:35
@user1179459 Most ISPs are better about "abuse" reports than you think. Honestly, I've worked with a few before when I was in your position and was pleasantly surprised usually. – Chris S Aug 22 '12 at 12:54


You could try hellbanning the user by IP.

A hellbanned user is invisible to all other users, but crucially, not himself. From their perspective, they are participating normally in the community but nobody ever responds to them. They can no longer disrupt the community because they are effectively a ghost. It's a clever way of enforcing the "don't feed the troll" rule in the community. When nothing they post ever gets a response, a hellbanned user is likely to get bored or frustrated and leave. I believe it, too; if I learned anything from reading The Great Brain as a child, it's that the silent treatment is the cruelest punishment of them all.

The idea is that he won't know he is actually banned and won't bother changing his IP again.

You could also try to implement a flash-based "cookie". These are different than regular HTTP cookies in that some browsers do not delete them when their browser cookies are deleted. (more info:

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.