Stemming the Tide of Comment Spam With a Tar Pit
Many [rmfo-blogs] users have had their Weblogs indexed enough by Google to now be suffering from comment spam. What follows is an tutorial for an advanced technique for stemming the flow of comment spam; this involves installing a WordPress plugin and going above and beyond the basic WordPress functionality for fighting comment spam.
The plugin covered in this tutorial is Dougal Campbell’s Spammer Tar Pit. Dougal describes the action of the Tar Pit pretty well:
If you have any IP numbers listed in your moderation_keys setting (that’s where you put the spam words in the Comment Moderation setting under Discussion Options), this plugin will check them against the current visitor’s IP number. If it matches, the visitor will get a delay (that’s the tar pit — it slows them down), then an “Access Denied” message. You can customize the delay time and the message of course.
Installing the Plugin
Go to the Tar Pit and download either the .txt or .phps version to your local machine. Rename the file to tarpit.php and upload it to your [rmfo-blog] via FTP. Then, go to the Plugins screen and activate it.
Configuring the Plugin
One configuration change that you may wish to make to the Tar Pit Plugin is to change the $send_email variable from ‘true’ to ‘false’; many of you are seeking to avoid having dozens of emails sent to your account, so flipping the bit here is probably a wise choice.
Using the Plugin
I like to dovetail my use of the Tar Pit with my normal deletion procedure. When I get to Step 4, I take the offending IP address and also paste it into the moderation_keys list in the database like so:
Click Update Options and you’ll have the data saved. Do this with every comment spammer’s IP and you’ll have a healthy blacklist built up after a time. Yes, you’re running the risk of blocking legitimate commentors, but that’s the risk that you run.
[Side note: I always do this in separate tabs of my browser. If you're using Internet Exploiter, you're missing out.]
October 31st, 2004 at 8:55 am
Video Poker Spam Attack
As an administrator of 50-plus WordPress installations, I’m well aware of the attack last night that spammed for “Video Poker”. How did this attack work when others did not? Neither “video” nor “poker” are words in the common spam words entry …