Is nopCommerce Secure?

I was doing some research on the customer system today and I noticed that ever 4 minutes for the past 20+ hours a new customer was being added to the customer database.  These customers have nulls for username and password and e-mail.

Is there any setting in nopCommerce that will prevent customers from setting up accounts with null userids and null e-mail accounts in on the customer login form?

I realize that I can turn on e-mail validation to try and guard against this but we wanted to make it as easy as possible for customers to register and were hoping to not need the e-mail validation feature.

Thanks,
Gary

What is your definition of secure?

Every time a visitor hits your home page, you get a guest registration. Don't worry about it. If you are concerned about using up ID numbers, run the maintence module (in admin) every day to delete the guest accounts. Be happy that you are getting hits!!

And requiring e-mail authorization won't eliminate this.

It's a good idea to use it -- it keeps the numbers of spammers and trolls to a minimum.

Even after I turned on the e-mail validation in the Customer settings, I am still seeing new records being added to the customer database every 4 minutes.

Can anyone explain this to me?

Does this mean that the App_Data/settings.txt file has been compromised?

Thanks Mike, just a hit will generate a customer entry in the customer table?  That is very interesting.

Don't you think that getting a new Guest account every 4 minutes on such a regular interval indicates something malicious?

...or could it be an indication that a search engine is crawling the site?

As Mike said, every time a visitor hits your home page, you get a guest registration. For more details check this: https://www.nopcommerce.com/boards/t/14824/has-the-guest-user-issue-been-addressed-in-the-new-24.aspx

SwimmingWorld wrote:

If it's that regular, is it possible you are using some kind of keep alive service (e.g. http://www.pingalive.com)?

If so, then see this  (I use it to ignore pingalive.com)

http://forum.arvixe.com/smf/tutorials/how-do-i-block-an-ip-address-with-web-config/

Also, look at your logs in Admin. You will probably see a lot of:

"The controller for path '/{some file name}' was not found or does not implement IController."

Click on 'View' and look at the detail on the error. It will show if it is created by a spider crawling through your site looking for missing or updated files, or is from an external search engine link, or by a bookmarked user looking for a web page.

I'm getting on the average of about 150-200 of these per day (I've got a heavily bookmarked and search engine linked site), and it's going to take time to settle out and get relinked. I do keep an eye on it though, and one thing I did do was to modify the "file not found" error page to indicate that the website has changed and a link to the new entry point. This helps to capture your customers who have bookmarked an old page that is no longer available on your new site.

Thanks Mike and New York,

We are not using any keep alive tools.

I am seeing log entries that match what Mike outlined.

Also, when I view the Guest customer details for a lot of the entries I see a entry for the last URL visited and by looking at several Guest records it appears that this is just a search engine crawling throug the site.  I feel better now that I understand that Guest records are created every time the site is hit and I will monitor this for a few days to see if the crawling eventually ends...at least for a while.

Thanks again everyone,
Gary