After switching from BadBehavior+Spam.module back to Akismet, I assumed I’d be in for a bit of an onslaught of spam. I was braced for impact. I can’t believe the sheer volume of sustained attempted spam comments that are constantly being flung against this blog, 24/7 now. It’s peaked at several attempts per second, which was adding a bit of a load to the server as it struggled to thwart the forces of evil.
Shortly after switching to Akismet, and enabling the experimental spam detection, I was seeing this:
Now, that might not look like much, but it suggests that Akismet was having to reject attempts several times per minute. Fast forward 24 hours, and I see this:
Again, not looking like much, but the interval between Akismet interventions is getting longer. Either the spammers are slowly starting to give up, or this is just a natural lull. I mean, there can be several minutes now without an attempted spamment posting. Entire minutes!
Now, the downside of Akismet is that I can’t use it on any of my campus projects. The cost of licensing Akismet for the number of sites we have would be prohibitive, given our budget asymptotically approaching zero dollars (CDN).
{ 10 comments… read them below or add one }
Hi I found your site and want to draw your attention to this technique:
According to Madd0’s blog, most spammers on his site arrive with a blank (empty) user-agent string. He further proposes to add a redirection to the .htaccess file to redirect blank user-agent browsers to 404 page:
# BEGIN WordPress
RewriteEngine On
# Redirect empty user agents to Access denied
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule . – [F]
Perhaps this could block some spammers.
Via
[Interesting spammer pattern - how they find sites]
Have you tried using Bad Behavior and Akismet in combination? Seems to work pretty effectively for me at the moment. Bad Behavior traps something like 95% of spam leaving Akismet with only the odd one or two to mop up.
I’d tried the combo before. I’m not in love with Bad Behavior because I’ve seen too many false positives, which essentially ban innocent bystanders from even seeing the website just because BB thinks they smell like spam. And, I was trying to reduce the amount of code having to run, hoping to improve performance on my server.
Did you try Spam Karma? That can be used without licence fee. It seldom misses any spam,
I’ve had mixed luck with the hidden field as well. Validation is pretty hard to get by, however. If your form has something like a phone number (which this one doesn’t) you can make sure that that field is a number. On one of my forms that gets hit hard I made the year mandatory (it’s a grad website so people need to put in the year they graduated). I did this because I noticed that the bots didn’t recognize that field as something special.
I wouldn’t know what to suggest for comments; on my own site I added an allowed time script… so you can only comment once every 10 seconds. This seems to work because I haven’t gotten spam yet (knock on wood).
yeah. with required fields for comments, it’s just a slippery slope on the way down to a Captcha, which is just plain wrong.
Even the time limits are possible to get around, by setting an interval on the bot…
Sharlene, I’ve tried the hidden form field trick as well, but smart bots actually get around it. I suppose the server could generate a unique “key” for a page view, and if it’s not passed back then it’s invalid. But that just begs to break. Occam’s razor, and such.
We constantly struggle with spam and forms here as well. It’s relentless. We’ve come up with a couple of neat ideas (like having a hidden form field and if that form field is filled in have a script delete it — theoretically only a bot would fill a hidden field in). Form validation is good as well — but that’s only handy when you have something like numbers to validate on.
Martin, Spam Karma (and Spam Karma 2) are WordPress plugins. This site (and all of my project sites) are running on Drupal. I do really miss SK2 – it was nearly bulletproof, and completely transparent.
Mike, sure thing. Thanks!
If I could contact you, I could give you some tips.
Mike