Stopping Spam Submissions & Fake Reviewer Accounts in OJS

Academic journals published on Open Journal Systems are high-value targets for automated botnets. Because OJS includes public user profile pages, author bio fields, and open registration forms, spam networks program bots to register tens of thousands of bogus accounts.

These fake profiles are stuffed with hyperlinks to illicit gambling, counterfeit pharmaceuticals, and cryptocurrency scams. In worse cases, automated bots submit fake manuscripts to test whether the journal allows unvetted auto-publishing or file uploads.

The most common mistake made by new journal editors is allowing public registrants to check the box: "Yes, I would like to be contacted to review submissions for this journal."

Bots check this box automatically, filling your reviewer selection pool with thousands of fake accounts.

Fix:

1. Navigate to Settings > Users & Roles > Site Access Options.

2. Ensure that users can register only as Authors or Readers.

3. Reviewer roles should always be assigned manually by Section Editors.

OJS features native support for Google reCAPTCHA. Open config.inc.php and locate the [captcha] section:

captcha = On

captcha_on_register = On

captcha_on_submit = On

recaptcha = On

recaptcha_public_key = "YourSiteKeyHere"

recaptcha_private_key = "YourSecretKeyHere"

recaptcha_enforce_ssl = On

Bots frequently use non-existent or fabricated email addresses. Forcing email verification stops automated registration loops dead in their tracks:

require_validation = On

When enabled, a newly registered user cannot log in, submit a manuscript, or update their profile until they click the confirmation link sent to their registered inbox.

To purge spam users without affecting real scholars, execute a targeted query that identifies accounts with zero editorial history:

WHERE user_id NOT IN (

SELECT DISTINCT user_id FROM stage_assignments

UNION

SELECT DISTINCT reviewer_id FROM review_assignments

UNION

SELECT DISTINCT user_id FROM user_user_groups WHERE user_group_id IN (SELECT user_group_id FROM user_groups WHERE role_id IN (1, 16, 256))

)

AND date_registered > '2024-01-01'

AND user_id NOT IN (SELECT DISTINCT submitter_id FROM submissions);