How to stop forum spam: a practical checklist

Any forum that lets people register and post will be found by spambots, usually within days. The phpBB team says it plainly in its install guide: the attacks are generally not personal, spammers are just looking for accessible targets, and admins should set up anti-spam measures right after installing (phpBB 3.3 docs/INSTALL.html, "Anti-Spam Measures").

At registration

• Use a question-and-answer CAPTCHA about your topic. Bots that beat image CAPTCHAs often fail niche questions.
• Require email activation, or admin approval while the forum is small.
• Limit registration attempts per session.

For new members

• Put new accounts in a "newly registered" group whose first few posts need approval.
• Block links and signatures until a member has a few approved posts.
• Don't let brand-new accounts send private messages.

Ongoing

• Keep software and extensions updated; old versions are easy targets.
• Check the approval queue daily, and ban plus delete in one step.
• Watch for "sleeper" accounts that register, wait, then edit old posts to add links.
• Back up the database before bulk-deleting spam.

Don't

• Leave registration fully open "just for launch."
• Rely on one measure. Layers work best.

More forum admin guides (moderation, SEO basics, backups): https://4freeforums.com/

I help run 4FreeForums.com.