Does every real user always have an agent?

[jezzer300]

I ask as a hacker who is continues to try usernames and passwords from a robot has a blank agent.

I was considering blocking anyone with a blank agent, or is it sometimes valid. Perhaps it can be disabled on certain browsers?

Regards,

Jez.

[Philosopher]

Yes, the user-agent string can be disabled in certain browsers. It is also commonly blocked by personal firewalls

Both instances will result in a request having no user-agent even though the visitor is real.

[jezzer300]

Thanks.

I wish I could get rid of these daft people running robots on my forms.

The one I have right now uses a different IP on each attempt and appears to be giving me the contents of a dictonary.

[Philosopher]

Sounds like what you really need is a CAPTCHA (one of those number/graphics that the user must enter to validate they are human).

Check out

[webmasterworld.com...]

Should point you in the right direction.

[jezzer300]

Thanks, it's something I've though about. Although for now it appears it would put off people completing our comments, mailinglist forms etc.