Question

I recently changed jobs. My last company hosted my blog on their own platform, which was nice b/c I didn't have to be bothered with these annoyances. But now that I'm on my own (in terms of blogging) I'm finding the spam to really be a nuisance. I've disabled trackbacks/pingbacks and turned on comment moderation. The spammers are getting clever in their messages and require a little more effort to differentiate between spam and actual reader comments. Thankfully the URLs spammers post give them away. When I have time plan to add a CAPTCHA to try and stop the remaining spammers. Any advice? It's such an annoyance!

Answer 1

Akismet has worked great on my blog, so far. In the past ~2 years, it has blocked over 50,000 spam comments automatically, and missed maybe a dozen that I had to manually mark as spam.

If you're using a popular blogging platform, renaming the script that handles the comment form POSTs helps also. Many of the spambots are too stupid to sniff the real location from your comment form, and just go for the default.

For example, I use WordPress. The comment form POSTs to wp-comments-post.php by default. I renamed it encosia-comments-post.php (and updated the comment form accordingly) and my spam comments dropped by more than half.

Answer 2

Trackbacks are DOA, because they were designed with zero security. Lost cause in my opinion. The blacklists will never keep up.

As for blog comments, I recommend a CAPTCHA -- ReCAPTCHA is always a great choice and there are lots of plugins using it for pretty much every blog platform out there.

If you don't want to go full-blown image CAPTCHA, you could try ..

• a honeypot CAPTCHA (don't post if this hidden form field is filled for any reason)
• a JavasScript CAPTCHA (only post if this form field was filled by a JavaScript function on the page)

.. as well.

Answer 3

I'm the author of WP-reCAPTCHA which is used on the StackOverflow blog as well as many other WordPress installations, so I might seem biased, but I'll try to provide a non-biased suggestion. Keep in mind that although I was contacted by reCAPTCHA to work on the official WordPress reCAPTCHA plugin, I am in no other way affiliated with reCAPTCHA.

Some people believe that CAPTCHAs dissuade readers from commenting. I believe this might be true in many cases, but reCAPTCHA seems pretty straightforward. Instead of using random generated strings consisting of numbers and letters, it uses actual words, well, most of the time. If you read about How reCAPTCHA works, you'll see that it only requires one word to be correct. So it won't be too strict on your users. This is worth noting whenever that rare oddball pops up where one of the words is completely illegible, you can simply type anything in. Of course, reCAPTCHA would benefit if you tried to figure out what it says, but it's not necessary.

To date, reCAPTCHA seems to be the only 'un-cracked' CAPTCHA system. I think I read an article where even 4chan gave up trying to crack it and instead just used the 'only one word has to be correct' trick.

I think that as more and more people learn what reCAPTCHA is and how it benefits everyone, they wont feel too bad having to type in responses to CAPTCHAs. To reiterate, the fact that reCAPTCHA uses actual words means people don't fuss over having to type them in, because it's natural. Many would take 'elementary' over an overly obfuscated 'S3x7Kd'.

That said, again, many people absolutely hate CAPTCHAs (Though it seems to be general consensus that reCAPTCHA is the best of them), and opt to go for other systems. Akismet is worked on by the same people that work on WordPress, and seems to do a really good job at detecting spam. For most people, Akismet should be enough. If you find yourself being targeted hard by spammers, then perhaps a combination of Akismet and reCAPTCHA would be best. reCAPTCHA stops all machine based attacks (read: OCR/scripts) but can't do much against paid-human spammers, which Akismet can then stop by scanning the actual comment's contents.

reCAPTCHA is nice in that it is accessible to anyone. Big sites like Twitter, Facebook, even some government websites, and Stackoverflow use it, but the very same solution is available to the Average Joe Blogger as well.

I forgot to mention. reCAPTCHA has another service called MailHide in which you provide an email address and it gives you a link. People can then click this link and they are presented with a reCAPTCHA, and after successfully solving it, they are presented with the original email. WP-reCAPTCHA has this functionality built in. If enabled, it scans posts and/or comments for email addresses and 'obfuscates' them. So johndoe@server.com becomes joh...@server.com. The viewer then clicks on the three dots in the middle and they are presented with a little, unobtrusive reCAPTCHA pop up. After successfully solving it, they are presented with the original email address. There are also settings to customize the obfuscation.

I just figured I would mention that, considering that you can also get spammed by email harvesters, and reCAPTCHA happens to fight off both things quite nicely.

Answer 4

Akismet has been really great. As a secondary measure, you can try using CAPTCHA's (though as some have noted, they are not the most reliable mechanism for preventing bots)

Answer 5

I've had good success (on Joomla) with:

• Bad Behaviour, and
• an extension which uses Honey Pot

I like these because they don't actually interrupt the user's experience; instead they compare the spam-bot's IP address, HTTP headers etc.. against databases and patterns of behaviour for known annoyances. It's solved basically 98% of my spam without inconveniencing my users at all.

Answer 6

On my blog I used to get endless spam comments that I was having to delete every day, far more than genuine comments. However, since I added a simple question "are you a person or a spambot?" to my comment form, I've not had any spam comments. I guess larger blogs might find that spammers soon catch on, but I'd say it's worth trying a simple solution first.

Answer 7

I use a four-pronged approach on my WordPress blog.

• Akismet is a must, and has been mentioned multiple times. It analyzes comments and attempts to identify spam
• Bad Behavior is another must. It detects the behavior/fingerprints of spambots and discards their messages
• Cookies for Comments checks to see if a cookie exists and, if not, marks the comment as spam. The idea is that your typical spambot is not going to have cookies
• reCAPTCHA is a CAPTCHA with the pleasant side affect of helping OCR recognition of old books

For really persistent spammers I resort to adding their IP addresses to a block list using JC-IPrestrictions.

While I don't use strict comment moderation, I do trap comments for moderation if they have two or more links in them. (WordPress setting.)

The result is very little spam and fewer false positives.

Answer 8

1. For wordpress use WP-Spam
2. Use simple captcha like on Coding Horror site

Answer 9

Akismet is an excellent solution, if you're non commercial

Answer 10

Akismet is a popular and effective anti-spam solution from the people that develop WordPress. Naturally it's integrated with all WordPress installations, but they have several versions available for other platforms. I've found it to be the most effective method, better than CAPTCHAs.

Answer 11

I've used Akismet on my blog for over three years. For the first few months, it caught over 3000 spam comments/trackbacks.

I do like having trackbacks on, but they were the main cause of my comment spam. I altered the trackback page to disallow trackbacks from .info and .biz domains (the cause of 100% of the spam). Since then (over 2 years), I've had about 10 spam comments and 0 spam trackbacks. (I have a very simple captcha on my comment form consisting of just entering a word - the same every time).

Answer 12

I use the Pivot weblog software which since version 1.4.something has used Hashcash technique on it's comment forms to prevent simple bots from adding comments. Since it was first added to Pivot, it has been pretty much 100% effective. I still get the occasional 1 or 2 spam comments a month, but I've no reason to believe these aren't added by hand (something you can never guard against).

Hashcash is slightly controversial in that it means the user has to have a javascript enabled browser for it to work, but I'm pretty sure that covers most websites these days. Some say it's bad for accessability, but at least users to my site don't have to squint at some bizarrely distorted image.

Oh, and the main complaint I used to hear about Hashcash when I'd tell people how effective it is (far more effective than Captchas and bayesian filtering), was that spammers will design bots to execute the javascript eventually and it'll become ineffective. Well, I've had it in place for 3 years or so now and there's no sign of it becomming ineffective yet. At the same time, other anti-spam methods are already thoroughly compromised. There must be considerable cognitive disonance involved in deciding to stick with something that doesn't work, rather than switching to something that does work but might not in the future.

Anyway, there must be HASHCASH plugins for other blogging software, so check them out now.