Tom Rogers

My personal and technology blog
Logo
 
 

Defending Your WordPress Blog Against Comment Spam

Posted on 14/08/11

in

369
Thanks!
An error occurred!

Throughout the two years that this blog has been WordPress-powered, I’ve learned about a number of the problems and challenges that the software faces. One of the biggest is spam commenting; out of nowhere sites seem to get bombarded by useless comments submitted automatically and in volume. Adding another level of complexity is the fact that it can be difficult to separate those responses that are genuine from those that aren’t.

As featured in an earlier entry, I recently hit this problem while restructuring and redesigning this site. Throughout the very long process, I discovered some things that will hopefully mean I won’t find myself in the same position again any time soon (there were almost 5,000 meaningless comments when I first looked). Not one to keep any pearls of wisdom close to the chest, I thought that somebody else might benefit from hearing what worked for me and maybe it’ll help to stop them getting into the same ugly situation that I was.

A Note About Akismet

This is a plugin that ships with WP and as a middle-man between your server and the API for the companion web service. Using a growing database of comments submitted by users, the algorithm decides which posts are spam and leaves them in a queue that can be reviewed by the site administrator. Although, I’ve not used it myself, reports for those who have appear to agree that it’s a pretty solid service but far from perfect. Plans are available in pricing from free to $50/month. I personally don’t see a need to be a subscription to such a service as it simply isn’t worth it for the amount of traffic I get.

Establishing What Is Spam

In my experience, this can be the most important but also most difficult step to take. Setting yourself a definite list of criteria allows you to more easily decide what is malicious and what isn’t. Moreover, you can make this much easier on yourself by displaying the set of rules to visitors nearby wherever comments get posted. This will create expectations of visitors which, if not followed, can offer an indication as to whether the comment can from a real person or a computer script. Humans can read the guidelines that you set but machines can’t.

The Delete All Pending Comments Plugin

Again, this is a plugin that you can drop in to your WP directory and run with. Quite simply, it does as it says on the tin and was specifically created for sites victimized by spam bombing. As the WP admin paginate pages of comments not yet approved. However, if you’ve got twenty pages worth of comments that are spam, it can be extremely laborious to go through each one and mark it as spam. Once activated, this great little script will add an option to the backend which will allow you to delete all pending comments at once.

The WP-reCAPTCHA Plugin

Even if you think that you don’t know what a CAPTCHA is, you’ve likely seen one before. A CAPTCHA is the little box at the end of many webforms that asks you to type the letters that you see in the graphic. They work because bots cannot currently electronically read images so, requiring that it is entered at all points on your website that user input will virtually eliminate spam from automated services. I choose to use a service called reCAPTCHA (hosted by Google) because it is reliable, has APIs for many systems and input from users is used to digitize books.

That’s all I’ve got in terms of recommendations but they do a pretty decent job together. Of note though is the fact that, although these solutions should help quite a bit, they aren’t foolproof. It’s still really worth checking the comments once in a while to ensure nothing has slipped through the net.

If you have any more suggestions or advice to share, please post them down below.

Your Responses

Chime In and Give Your Thoughts

Comment Posting Guidance

For the benefit of every non-spambot visiting, following a recent site restructuring I have some rules with regard to etiquette for comment posters. As well as making a better experience for all, they help to distinguish real people for automatic evil machine spam. Due to this, any comment that fails to follow any one of them will be considered spam and removed as soon as possible.

With thanks, Tom

  • Coherent English must be used.
  • This form has multiple fields for a reason. Only enter a real name or nickname in the first box i.e. "Boats For Sale" wouldn't make it. Similarly, the "Website" input is a pre-determined place to post one link so there is no need to have them in the body area. This is a common technique used by spammers and marketers and, as such is not allowed.
  • Your comment must be directly related to the post to which it is a response. The idea of a post commenting system is to further the conversation that began in the given article. For instance "great post" is not a comment. My contact form can be used for suggestions or general communications.
  • Responses to other comments must be civilised.
  • No sexual reference or content is allowed.
  • Duplicate comments are a no-no.