Title: comment spamming Last modified: December 20, 2016 --- # comment spamming * [Chris J. Davis](https://wordpress.org/support/users/chrisjdavis/) * (@chrisjdavis) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/) * I am in the middle of developing a system to thwart this epedimic. At this point I have written a script that queries the IP of the client trying to connect and compares that to a table in my database, then if it is passed it loads the content. I am about to write the second part of this that will add a button to all the comment lines in the admin panel, allowing you to add an IP to the ban list with one click. I was wondering if others were interested in this, or if it is something that is already being worked on? I will write this according to the parameters set forth for hacks of others want it, if not I will make it quick and dirty. I just wanted to know if there was alot of interest in this or not. Hit me back on this thread with thoughts, or if you would like something like this added to your blog. Jesuit Viewing 15 replies - 1 through 15 (of 26 total) 1 [2](https://wordpress.org/support/topic/comment-spamming-2/page/2/?output_format=md) [→](https://wordpress.org/support/topic/comment-spamming-2/page/2/?output_format=md) * Anonymous * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24596) * Hmm, I think blocking the comments entirely is probably not ideal. The problem( same as with IP based email blocking) is false-positives… A possible solution: You could add a flag to the comments table to not show the comment, however the email notification would still be sent and it would still be shown in the comments list (wp-edit.showcomments.php new in CVS as of yesterday). What do you think? * Thread Starter [Chris J. Davis](https://wordpress.org/support/users/chrisjdavis/) * (@chrisjdavis) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24598) * Sorry must have misunderstood my solution. The index page queries the client IP before any content at all is loaded, then your blog is seen only after the IP has passed the check. This is a more… how do you say, extreme aproach, but if the page loads content there is always a chance for the bot to circumvent your security measures. Anyway I will look into your idea, I see some real possibilities in it. Thanks as always Alex. Nice talking to you again, been awhile since the b2 forums. * [alexkingorg](https://wordpress.org/support/users/alexkingorg/) * (@alexkingorg) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24606) * Hi Chris, I was glad to see you here as well. I’m looking forward to seeing what you come up with. I did misunderstand what you are proposing. I was thinking you checked the IP address when saving comments, not loading any page. I think some kind of content filtering system combined with a IP filtering system that flags questionable comments and hides them from being displayed until they are‘ approved’ is probably the way I want to go. This is the same attitude I have towards SPAM in e-mail, I know some people that auto-delete it. Personal preference I guess. 🙂 * Thread Starter [Chris J. Davis](https://wordpress.org/support/users/chrisjdavis/) * (@chrisjdavis) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24607) * Yeah I will concede to you on that one. I hacked this together prety quickly just to get some defenses in place, but I can see where down the line this would not be the most advantageous way to do things. I hope to look at this over the weekend and try to come up with something a little more flexible. The way wordpress is progressing makes me feel all warm and fuzzy, good to see you using your knowledge for good! Chris * Thread Starter [Chris J. Davis](https://wordpress.org/support/users/chrisjdavis/) * (@chrisjdavis) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24635) * Well I have completed my stop-gap measures, by adding a block IP function to Alex’s recent comment hack. Now along with edit and delete is a block IP link that adds the ip of the spammer to your banip table. When I get home I will package everything up and release it for those who are so inclined. This is not the most elegant or flexible aproach, but it get’s the job done, and that is what counts for me right now. Thanks to Alex for his really groovy comment hack, I so did **not** want to write something like that today. Well anyway, for those who would like to give it a whirl, you can pick it up at chrisjdavis.org/docs after 8:00pm est. Again this is only temporary I am sure the admins are hard at work writing something that will make my silly little hack blush and giggle like a little girl. But until then we have a measure of protection. * [erogers](https://wordpress.org/support/users/erogers/) * (@erogers) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24636) * How would you account for ISPs where all users appear with the same IP address? For example, all users at my workplace would show up with the same IP address. I’ve already encountered a couple of blogs where I was unable to comment because someone else in my organization got our IP address banned. * Thread Starter [Chris J. Davis](https://wordpress.org/support/users/chrisjdavis/) * (@chrisjdavis) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24643) * Never said this was a perfect solution, just that it was a stop-gap for me until something else is written or suggested. I was offering it to the general public as a courtesy, nothing more. Honestly in answer to your question, I have a high enough readership that losing someone from an IP range that is known to spam isn’t that troubling to me. I had already gone through this before writing it, and I came to the conclusion that for me it wasn’t an issue. It might be for you, which is a valid concern; if so this is not the correct solution for you, no hard feelings. If you still wish to use this, you could always add an email contact to the spammer message, allowing actual people to contact you and be removed from the blacklist, that would be rather simple. You can go here: [http://hiveware.com/enkoder_form.php](http://hiveware.com/enkoder_form.php) to find a very well bred email incoder that will thwart 99% of the bots out there. Again as I said before this is not an end all solution, just a stop-gap. Don’t use it unless your needs are met by it. I am not going to submit this to WP or any nonesense like that. Alex and I have already had some dialogue concerning this issue and what he and the devs wish is much more flexible and powerful than what I have hacked together. I might look into implementing something like what Alex and I discussed, but not now. Too many other projects breathing down my neck as it is. Thanks for your concern and input erogers, and I hope you find a comfortable solution to your own spam problems if this hack doesn’t suit your needs. I hate comment spam. * [huphtur](https://wordpress.org/support/users/huphtur/) * (@huphtur) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24775) * Comment spam is a hot topic lately: [milov](http://milov.nl/2303), [jayallen](http://www.jayallen.org/journey/2003/09/killing_comment_spam_dead), [asterisk](http://www.7nights.com/asterisk/archives/damn_comment_spam.php). What about expanding the wordpress registration process with an email validator? And only allow validated users to post comments? * [alexkingorg](https://wordpress.org/support/users/alexkingorg/) * (@alexkingorg) * [22 years, 7 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-24777) * I think a combination of content and IP filters that will flag a comment as “ needing review” if it meets a spam threshold is the way to go. If a comment is flagged as “needing review”, it will not show up on the site until it is approved by someone who has that authority. It could, of course, be deleted (and reported) instead. * Anonymous * [22 years, 6 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-25078) * Another way it can be done is by having a list of commonly-used URLs by the spammers. This way, anyone who posts from those domains will automatically be blocked. There’s a list of all kinds of anti-spam hacks for moveable type here: [http://www.scriptygoddess.com/archives/004325.php](http://www.scriptygoddess.com/archives/004325.php) It would be really great if someone could code some of these for b2/wordpress! * [Sushubh](https://wordpress.org/support/users/sushubh/) * (@sushubh) * [22 years, 6 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-25081) * LJ has this option where u can switch on comment review to prevent spamming comments. this way you can read the comments and make them visible on the site… * Anonymous * [22 years, 6 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-25085) * Where is the comment review solution? That seems simplest allow you to accept/ reject all comments. * [otaku42](https://wordpress.org/support/users/otaku42/) * (@otaku42) * [22 years, 6 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-25100) * Comment review (comment moderation) is currently under development. Actually, I’m the one writing this. The wp developers took a review recently and suggested some improvements. I didn’t find the time to implement them all this weekend, but I guess this should happen during this week. As soon as the solution gets the OK from the wp developer crew I’ll release it as hack for 0.72, and I suppose it will go in to the next release version of WP as well. * [Simon Hampel](https://wordpress.org/support/users/sim/) * (@sim) * [22 years, 6 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-25125) * Another thing you could check for an automated “suspicious comment” filter – is to check for the number of links added to the comment. Most comment spammers seem to be trying to take advantage of the google weighting of blogs by increasing the number of links to their sites, thereby making their results appear higher in the google hit list. Anyone with more than two links in a comment is highly likely to be spam in my opinion. * [otaku42](https://wordpress.org/support/users/otaku42/) * (@otaku42) * [22 years, 6 months ago](https://wordpress.org/support/topic/comment-spamming-2/#post-25129) * There has been LOTS of discussion recently in the bloggosphere about suitable methods to recognize and automatically suppress spam postings: sorts of blacklisting something, filtering manually or automatically, using bayesian algorithms, restrict comment posting more or less, use CAPTCHA methods to keep out bots, and so on. Your suggestion is another method, and I didn’t see it before. It will work as you described, classifying comments with more than two links per comment as spam. This will stop one class of spam, the one having tons of links in one comment. But… I think this won’t be a longer-term solution. As soon as spammers realize they can only post two links per comment, they’ll do so. Instead of posting one comment with 20 links, they’ll post 10 comments with 2 links inside. You could decrease the limit to 1 link, so they’ll post only one. You could permit link posting, but that would be a high impact on usability for legitimate users (and an increase in work for you, as you had to manually approve all submitted comments having links inside). And if you let through all comments without links in their body, you’ll see an increase in another method some spammers already use. It’s a decent way of spamming, not as offending as the “bulk url list” comments you mentioned before. It’s a method I’d describe as “smart spamming”. Those spammers put their URL in the URL field, while posting a comment that seems to be ontopic on the first sight. A nice example for this can be seen [here](http://www.lxsa.org/archives/000016.html). You won’t catch that at all by just counting the number of links in the comment– there is no link. So, we need another method. Turning of the URL field would be an decrease of usability of blogs – and we don’t want that. Moderating all comments with an submitted URL would be an increase in work for the administrator– something we would like to cut down to a minimum, of course… Personally, I strongly believe that the URLs themselves are the key. Whatever other options bloggers might try to suppress unwanted (spam) comments, spammers will find a way to get around the restrictions more or less easily. There is only one thing that really can’t be changed without making the spam useless for the spammers: the URL. They have to give at least one link, else google won’t push their page rank – and that’s what this damn spam phenomenon is all about, right? Cloaking the main URL somehow (for example, giving the link to a redirecting page) won’t do the trick for them, because it most probably will have an impact on page rank as well (and thus be negative for the spammers). There isn’t much they can do to get by this way of filtering, I think. If the URL is the only key to rely on, blacklisting spam URLs is the answer. It’s easy to implement, not too hard to keep up-to-date (in fact I’m thinking of a standalone tool that helps on managing blacklists and that help to strengthen out a “web of trust”) and safe. If you want to be sure that no spam comment makes it through to your blog you also might consider to enable comment moderation – but even without general comment moderation you’ll catch most of the spam without having to raise a finger. In my eyes these two solutions are the most effective methods to keep your blog free of spams. Or to speak with the words of [Club vs. Lojack solutions](http://diveintomark.org/archives/2002/10/29/club_vs_lojack_solutions): URL blacklisting, amongst the other solutions that have been proposed so far, is the club solution that is the nearest to a Lojack solution of all other clubs. Maybe I missed an important point. If so, I’ll happily stand corrected 🙂 Bye, Mike Viewing 15 replies - 1 through 15 (of 26 total) 1 [2](https://wordpress.org/support/topic/comment-spamming-2/page/2/?output_format=md) [→](https://wordpress.org/support/topic/comment-spamming-2/page/2/?output_format=md) The topic ‘comment spamming’ is closed to new replies. * 26 replies * 16 participants * Last reply from: [rossz](https://wordpress.org/support/users/rossz/) * Last activity: [21 years, 4 months ago](https://wordpress.org/support/topic/comment-spamming-2/page/2/#post-25359) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics