Simtropolis Sign in security

[TheCrybKeeper 300]

It is CRAZY trying to sign in to a game website, with too much security hoops to jump through.

My PalPal account doesn't do all of this crap! Nor my bank, Steam, anywhere else and even Fort Knox is easier to get into!

[Cyclone Boom 16,875]

I feel it's important to clarify why these security measures are in place. While I understand extra steps to sign in are frustrating, it's like comparing the locks on a local shop to the vaults at a national reserve! Sometimes in a high crime area, a small shop requires more visible protection to stay open (than a branch located in another part of town). Also large platforms run on very different infrastructure and can afford expensive, often invisible security solutions. We're doing the best we can for ST with the resources available.

Each website faces its own set of circumstances, and our focus must be on what's right for Simtropolis, rather than copying what other sites do. We also faced a specific attack that required a custom developed firewall. Many malicious bots were getting through standard Cloudflare challenges and hindering server performance. Over several weeks I examined each type of attack and then developed a dedicated security layer to stop each of those bots. In addition, the CAPTCHA on the login form helps prevent attackers from brute forcing user accounts, especially those which use weak passwords.

Just because other community sites have fewer hurdles, doesn't mean they face the same level of risk. Given we've been around since 2002, Simtropolis is a high profile target for scrapers and web attacks. If we simply did what everyone else was doing, the site would remain vulnerable to the attacks which were previously slowing it to a crawl.

In most cases these checks only apply to guests. Signed in members are allowed through automatically. This means when signed in, you should not normally encounter these challenges. I explained the background and reasoning in more detail previously, so you may wish to see my post here for the full context.

Although there's always a balance to strike, security and stability must come before absolute convenience. Yesterday alone there were over 15,000 bad bots who were denied access (and 300,000+ in the past month). That's why there are multiple layers of security in place. Each layer is designed to catch a different type of threat. If we don't protect the site, there would be serious consequences for the community.

So I believe these steps are the most responsible course of action to ensure the long term health of Fort Simtropolis.

Note: As an aside, since your post is related to ST itself, I've moved it to the Simtropolis Related forum.

[Lab Rat 13]

Automated Notice Message

All posts after 1 March, 2026 @ 01:37 GMT were lost in the site crash.

We've added this message thread divider in every topic across all forums for what were then active threads. (We decided active is if the most recent extant post (from the backup) was on or after 1 January, 2026.)

This divider serves as notice that the conversation was interrupted. Answers and further discussion which used to be here have been lost. Keep this in mind when replying. Our hope is to rebuild what is missing.