36

I'm a bit perplexed why I keep getting so many spam comments ...

alt text

Even though I use both the Akismet and WP-reCAPTCHA plugins on my WordPress blog!

  • WP-reCAPTCHA should stop machine entered spam, but I understand spam entered by human beings will still get through -- and there are more and more human being spam farms, it is true.

  • Akismet (which is built in to WordPress!) should match any common spam URLs in something like real time plus or minus four hours, right? It's a collaborative world-wide URL blacklist.

I verified that both Akismet and WP-reCAPTCHA are set up, enabled, and have valid API keys. Am I doing something wrong? Do I misunderstand how Wordpress works?

Improve this question
  • Are you sure you have enabled Akismet? :D – User Oct 17 '10 at 0:07
  • Most questions here address re-captcha, but I'm really surprised that Akismet is not working well for you! It almost never lets a spam comment slip through in my case (although admittedly your blog has waaaay more traffic). – UncleZeiv Oct 17 '10 at 0:21
14

On the Akismet side, a few things to note. First, in wp-admin under 'Plugins -> Akismet Configuration' is everything green? You mentioned that you confirmed the API key is correct. Did you check the 'Server Connectivity' section? All of the IP addresses listed should be green. If not then you server isn't able to make the needed requests to akismet.com to determine if a comment is spam or not.

The second, as Nakodari noted, make sure that you mark any comments that Akismet missed as spam. This allows Akismet to learn. If spam comments have been missed, or marked by some other plugin as legit then you may be throwing off Akismet's results for your site.

Third, are there any other plugins on the site that could be interfering with Akismet? You mentioned WP-reCAPTCHA. Have you confirmed that WP-reCAPTCHA and/or any other plugins on the site are not preventing Akismet from doing its job?

As always you are welcome to drop us a line - http://akismet.com/contact/ - for Akismet related items.

Improve this answer
8

WP-reCAPTCHA should stop machine entered spam

Sorry Jeff, there are any number of nefarious sites out there that provide easy programatic API's for breaking CAPTCHA's. Sadly, a lot of these are done by people in real time, but to a bot that is just an implementation detail.

Here is one: http://www.kourkouta.com/service.php

A while back I wrote an automated program to play Mob Wars (lame I know) for me on Facebook using Selenium RC. Eventually the guy started introducing CAPTCHA's and I ventured into the dark side. I found some shady off-shore company that offered a FREE web service you could upload CAPTCHA images to and get the result. I integrated that into my program, and it never missed a beat.

Anyway, just saying that most CAPTCHA's are little more than a digital nuisance that bots will go sailing past.

And didn't you write a blog entry once upon a time telling bloggers the most effective way to deal with Spam was to just read your comments and delete the spam ;) I think you may have even used a gardening metaphor. But I suppose it is a different world for you now... economies of scale and all.

UPDATE:

Here is the quote and the citation you requested:

I've had plenty of experience with blacklists. A miniscule percentage of spammers have the resources to bypass my naive CAPTCHA. They hire human workers to enter spam comments. That's why I enter URLs into a blacklist every week on this very site. It's an ugly, thankless little thing, but it's necessary. I scrutinize every comment, and I remove a tiny percentage of them: they might be outright spam, patently off-topic, or just plain mean. I like to refer to this as weeding my web garden. It's a productivity tax you pay if you want to grow a bumper crop of comments, which, despite what Joel says, often bear such wonderful fruit. The labor can be minimized with improved equipment, but it's always there in some form. And I'm OK with that. The myriad benefits of a robust comment ecosystem outweighs the minor maintenance effort.

Improve this answer
  • If you're arguing there has been a class break on ReCaptcha then I need a citation on that. And no, I never said what you're claiming. Yet another citation you need to provide before making stuff up.. – Jeff Atwood Oct 17 '10 at 7:19
  • not economies of scale. just scale. – rsman Oct 18 '10 at 8:18
  • 3
    @Jeff, It is an indirect reference and I will be the first to admit that it doesn't apply in the context I framed it. However, I wasn't trying to bust your balls on this one. Clearly my memory took away something other than the original intent of the post from whence that quote came. A classic "Cool Hand Luke" moment. However, calling someone a liar flat out is pretty harsh. As for the captcha thing, I am not necessarily implying that someone has written a programmatic break for reCaptcha, only that a bot can still utilize a Human Network breaking service. – Josh Oct 18 '10 at 13:46
  • fair enough. I think those comments predate massive scale 100% human being spam farms, which have emerged as a major force in the last year or two. The distributed blacklists are pretty effective against these guys because they always have some unique top level domain fingerprint -- and captchas, sadly, are useless against human "opponents" – Jeff Atwood Oct 18 '10 at 21:32
  • @Jeff, yeah it sucks pretty bad. It seems there is no end to douchebaggery in the world and no matter how hard you try to defeat the nonsense, these guys always come up with a way around it. And just think if they put that much effort into being legit... – Josh Oct 18 '10 at 23:55
7

with wp-recaptcha, robots can still post comments. these spammy comments are marked as such and don't show up your blog, but will still appear in your comment queue. see the wp-recaptcha faq for a more detailed explanation.

Improve this answer
  • 2
    That links also covers that it doesn't play well with Akismet. – Rarst Oct 16 '10 at 21:16
  • @Rarst - well actualy it does not say that but that if something goes through recaptcha - it will end up in the spam queue (if you turn that option on).. – tkit Dec 7 '10 at 22:35
6

Bad behavior: http://wordpress.org/extend/plugins/bad-behavior/ works for me.

Improve this answer
  • Bingo - my suggestion is to combine Bad Behavior and Akismet. Together they really work well. – Chris_K Oct 16 '10 at 21:47
5

Welcome to the greater Internet! WP-reCAPTCHA can do nothing because most creative spams are human generated. Akismet should be able to catch them but they cannot do it unless their database is updated which I believe is updated every month or week, not sure.

One way I have found to eliminate such spams is to MARK them as Spam. Wordpress provides this option for a reason. I have noticed that once I mark these comments as SPAM in the latest version of Wordpress, they never come back. The next time a similar comment is found, it automatically gets added in the "Spam Comments" section.

I hope this helps!

Improve this answer
  • This problem has been ongoing for the last few months. I must have marked two hundred "hats" and "boots" spam comments as spam, that does not appear to work for me. – Jeff Atwood Oct 16 '10 at 21:10
  • Look and monitor their IP addresses, most spam comments come from about 10 or 20 different IP addresses and that is it! Once you block these IP addresses from commenting, you will greatly see a decrease in spamming! – Nakodari Oct 16 '10 at 21:12
  • hmm, I would hope eventually WordPress is smart enough to auto-ban a commenter's IP when I click "spam" on 20 of their comments in a row and they all come from the same IP.. – Jeff Atwood Oct 16 '10 at 21:20
  • I guess the folks at Wordpress are just busy! Not all spams can be stopped. You will be surprised how many startups open up in Russia, China, India, Pakistan, etc who focus on promoting products via spamming. Spamming is the only way of livelihood for such people. random ramblings – Nakodari Oct 16 '10 at 21:33
  • I don't know official position on this, but native WP anti-spam features (core, not Akismet) available under Settings > Discussions hadn't been touched in 2+ years I am using it. I don't think any improvements are going to get in core, at least as long as every installation gets forcefully stuffed with Akismet. – Rarst Oct 16 '10 at 21:36
4

I think the amount of people doing data entry commenting (see hundreds of jobs out there...: http://www.freelancer.com/projects/by-job/Forum-Posting.html ) will defeat the purpose here of a spam checker. They are used on many different workplaces and each time "new jobs" are offered to other people.

I think it is best to in the first place remove the websites they drop and all href tags so even if it succeeds it is useless.

Maybe some new global indicator "you can not post links here" is needed which they can check by a giant logo and that will leave your site alone :)

p.s. these job boards learn me lots of new terminology e.g. " need 500 Web 2.0 style profile pages created using the Angela/Paul/Terry Kyle Profile link building method. If you dont know what this is please dont bid." WTF is a Angela/Paul Terry Kyle profile??

Improve this answer
  • Yes. The going rate for human-powered CAPTCHA defeats is $1 per thousand. Incredibly cheap. – John Dec 26 '10 at 10:18
3

"...spam entered by human beings will still get through -- and there are more and more human being spam farms, it is true..."

This is the price of success.

There are indeed "farms" out there, esp. in third-world countries, that hire folks for pennies per hour to copy/paste/post comments and links in popular blogs.

Unfortunately your best option to eliminating these as much as possible is to require some kind of authentication (OpenID, Facebook Connect etc.).

Improve this answer
  • 2
    random plugin idea: crowdsource the spam flagging. have some subtle box fade in and ask you if you think a comment is spam or not.. use the stats to do the spam identification the blog owner previously had to. esp. good for popular sites. – russau Oct 16 '10 at 22:02
2

Try Defensio instead, they've had a solid spam filter for several years now.

Improve this answer
2

The other way to stop bots is through the 'hidden input field' - i.e. a field that is hidden from view and is made obvious for screen readers that it shouldn't be used, but if it is filled out then the comment is ignored.

wpmu.org have a good review of the Spam Destroyer plugin by Ryan Hellyer which should do just that as well as using a cookie.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.