May
2
2007
I love spambots

Well, in a certain sense anyways. Most of the time they're just pathetic little programs that try their hardest to post Viagra ads on your site. But over the past few years WebNV has seen more and more spammers access this site and try to post their garbage. I hate to say it but some do get through. And since I'm running my own cms, it means a lot more work for me to try and stop them. Luckily I like a challenge.

Since more and more spambots have been accessing my site and trying to post comments, I've had to adopt several different anti-spam techniques. When I first started my web site I got no spam at all. This may of been due to the site's freshness, or the fact that I was running my own cms and many spambots couldn't figure it out. But that didn't last long. Soon the spammers sent their little spam-droids to attack my comments system. There were only a few at first, but since I didn't have any anti-spam or comment moderation in place, they were damn annoying.

Enter the captcha. Oh everyone loves the captcha. I know everyone's seen it in some form on the web. Captcha's are those annoying little images where, for example, you have to enter the hard-to-read letters and numbers into the box to prove you're a real human. At the time this was the most popular way and acceptable way to stop spam. So I implemented it into my site. Sure enough it stopped the spam, and life was good.

But captchas were annoying and a lot of people, including myself, didn't like them. So many other methods for blocking spam arose. I got rid of the captcha on my site and went for comment moderation instead. But this wasn't your normal moderation where I would have to approve every single comment before it was displayed on the site. Nope. This is the more high-tech moderation in which visitors with previous comments that have been approved on the site, will have all their future comments auto-approved on the site. But if you're a new visitor (or spammer) with a first time comment, then it would first have to be approved by me to be displayed on the site. If it gets approved, then all your future comments will automatically be approved.

This method worked great for me for a year or so. It kept all the spam off of my site and away from all my visitors. But I still saw the spam. When I would log into the back end of my site I would see more and more unapproved spam comments waiting in the queue. And as time went on, the number of unapproved spam comments increased. Soon it would get to the point where I would login and see 100+ spam comments waiting for my approval. Sure it was easy enough to delete those comments, but it was still annoying that I was seeing them. I wanted to stop their comments from being submitted at all.

So I adopted another method which includes a hidden field in the comments form that only the spambots will see. All my normal visitors will not see this field and thus will not fill it out. But the spambots will. And if anything is put into this hidden field, then the comment will not be submitted. Again, this method worked for a while. It drastically cut down the number of comments I was seeing on my end, but there were still a few that would get through. Damn you!

Anyways, here I am today implementing another anti-spam method. This method has to do with blocking access to non-referrer requests. It's a little more complicated, but you can read about it here. I just implimented this method today so let's give it a week and see how it works *crosses fingers*. And as always, if any of my legitimate visitors are having any trouble posting comments, then please contact me and let me know.

Thanks, and wish me luck.

Author's Pic
// Article Summary
This article was published 3y 4mon ago on Wednesday, May 02, 2007 11:36 am by Nick Villescas. It was published under the following topics: Programming, Site News and with the following tags: coding, spam. So far this article has received 872 hits with 9 comments.
9 comments
3y 4mon ago // May 03, 2007 4:14 am
The Smith // guest

Gravatar

For all new episodes of Smith Blog and free mead to make you bigger and as seen on tv visit http://www.youtube.com/smithblog 

lol

3y 4mon ago // May 03, 2007 11:46 am
Nick Villescas // author

Gravatar

Heh, at least it's not an ad for xxx sex. I see plenty of those ads and they're hilarious.

3y 4mon ago // May 03, 2007 4:27 pm
The Smith // guest

Gravatar

Want lots of hot sexx go to http://www.youtube.com/smithblog to get all your sex and timeshares!

3y 4mon ago // May 04, 2007 1:05 am
iamthelordhitman // guest

Gravatar

Want to have fun? Bash religion? Be amongst people who have no idea what they are talking about?

JOIN PORTAL FORUMS! It's your ticket to happyness! www.portalforums.net

oh wait......

xD

3y 4mon ago // May 04, 2007 1:08 am
Nick Villescas // author

Gravatar

DAMN YOU SPAMMERS!!!!!11!

3y 4mon ago // May 04, 2007 1:21 am
iamthelordhitman // guest

Gravatar

hate the spam, not the spammers

<_<
>_>
<_<

3y 4mon ago // May 04, 2007 2:19 pm
microdesign // guest

Gravatar
pff. im getting pretty sick of it. im like working 2 hours after a weekend to delete all spammmm
3y 3mon ago // May 07, 2007 10:10 am
ghooghe // guest

Gravatar
The hidden field technique is quite efficient, but as you said, it's not perfect.
An improvement of this technique would be to "obfuscate" the form field names.
Let me explain it: you create a form with extra hidden/"parasite" fields, and then you random the name of the fields on the client html. Of course, on the server side you keep the mapping between the client "obfuscated" form and the real form using an identifier for each generated form.
It makes it much more difficult for the bots to distinguish between parasite from real/working form fields.
Just my 2 cents
3y 3mon ago // May 07, 2007 10:45 am
Nick Villescas // author

Gravatar

Actually that's what I'm doing. I created a few different arrays with words, letters, and numbers. Then I randomly pick several different items from the arrays and merge them together. This then gets me the name of this 'hidden' field. This 'hidden' field is also randomly placed in form. It can appear first, in the middle, or last for example.

I works pretty good, but some spam still gets through.

Add your comment
// required


Allowed Tags // <a><ul><ol><li><strong><em><blockquote> // required


This form is protected from spam by Akismet. Comments are Gravatar enabled and also moderated.