New member moderation. New posts from new members go through a moderation queue to await approval of the message. No one but moderators see the message. Members that are not spammers can have moderation turned off just for them and they can post freely.
Trivia questions. Create and ask the guest a unique question when they want to join the forum. Better than a CAPTCHA - if every forum has a unique set of questions, especially if the set includes a few product-specific questions, spammers won't bother to join in the first place.
Essay question: Why do you want to join this forum? Moderator approves the answer.
Profiles are private unless made public.
All profile changes have to be approved by a Moderator.
E-mail address domain blacklists. Block registrations from domains such as Hotmail or Yahoo. Set of
SQL queries is included to quickly set up a blacklist (contains 100+ freebie e-mail sites in ready-to-run
SQL statement format).
Limit the number of accounts that can be created in a day by one person.
Limit the number of
SQL queries a guest/user can execute.
Anti-
SQL injection code. Used for every query - even for variables that make no sense to use it for (e.g. typecasted variables to integers - harmless to do so but overkill is better than having a vulnerability).
Anti-
HTML injection scripting code. Prevents/eliminates cross-site security vulnerabilities. Again, overkill use.
Administrator and Moderator accounts are two completely different privilege levels with different privilege sets. The Administrator account cannot do anything but enter the Administration Panel (can't even see the forums!). By default, the Administrator account is a randomly generated username and password. Security of the Admin. Panel is taken seriously.
Passwords are hashed in the database (one-way hash). Recovering passwords is impossible but keeps user passwords away from the prying system administrator's eyes. Security for the user is important too!
Four privilege levels and custom privileges. Lower levels cannot see user information of those with higher levels. Users cannot, for instance, see user profile information of Moderators or the Administrator. Custom privileges allow for moderators with different privileges as well as the ability to set up special forums that only customers can access (purchase system integration - e.g. customer buys a product and gets forum-based technical support for a year via a special forum that uses custom privileges).
Maintenance mode. Locks down the forum so only the Administrator can use it.
IP address restriction configuration options for access to the Administration Panel. Administrator token is stripped from the user if they are not at any of the configured IP addresses.
IP address restriction configuration options for access to moderation functions. Moderator token is stripped from the user if they are not at any of the configured IP addresses. That is, they become just a regular user.
Spider/bot script limitations automatically bans users who intentionally abuse forum bandwidth. An exceptions list exists so that search engines can index the forum.
Installation is manual. Wizard-based installs of forum software provides insecure access to the backend database.
Upgrades are wizard-based but securely performed from the Administrator account. Forum automatically locks down (maintenance mode) upon upgrade availability to keep the forum secure. Upgrades include complete rollback functionality in the event of an upgrade failure.