Mitheren.com

I’ve had a fair few issues with spam on my WordPress sites and now I think I’ve finally found a good combination of plugins to solve it!

For years now I’ve been bombarded with emails telling me about all the new users that have come and registered at my site and all the wonderful comments that they’ve left but all I ever really did to stop them was install a reCAPTCHA plugin. A couple of weeks ago I decided that enough was enough, and that it was time to do something about it! Now usually these situations see me getting more and more frustrated as I try more difficult and complex things that just don’t work, but thankfully this story is decidedly shorter and happier. All I had to do was install and configure two fairly easy but powerful plugins; Sabre and Bad Behavior.

Bad Behavior is a tool that attempts to block link spam from being posted on your site, and more importantly, blocks spammers and their robots from even seeing your site in the first place. Whenever a connection is made to your site it checks the user for a number of criteria like if the host is trying to use POST where there isn’t a form or if the user is on a blacklist. If it decides that the user is there to conduct some ‘bad behavior’ it doesn’t even serve them the page and instead just gives a HTTP error. Not only does this limit the amount of nasty link spam all over the site, but it can also reduce server load by not generating pages for illegitimate viewers.

On the other hand, Sabre (Simple Anti Bot Registration Engine) is exactly that, it stops bots from registering on your WordPress site! It can perform a number of different tests on the would-be-user to determine if they are a human or not including CAPTCHA, a basic math question or admin validation. It offers some better tools than this though, it allows the use of invitation codes, policies/disclaimers that must be agreed to, javascript tests, blacklists and tricks. For example on Mitheren.com, a user is currently unable to register if their IP matches a blacklist, or if it fails one of a number of stealth tests such as a minimum time to complete the registration, if the registering IP is the same that asked for the registration page, ensuring the registration page is loaded before submitted and a tricky box on the submission page that must remain empty for the submission to complete successfully (see the sign-up page). Another powerful tool is the ability to block registration if the user does not allow JavaScript as this is a common trait of spam bots, but it hasn’t come down to that yet.

Since I’ve installed these plugins I haven’t had a single spam bot attempt to register, I’ve had a huge number of would-be link spam commentators blocked and I’ve only had one successful spam comment posted, and that was caught by Akismet. I didn’t mention Akismet above because it’s a tool that every WordPress admin should have configured and enabled from day 1. I’m fairly sure it still comes bundled with WordPress and is a great tool that blocks the vast majority of spammers that make it far enough to comment. The only other suggestion I can give is to keep everything as up-to-date as possible, but be wary of new releases! Check them out on a test site and read some feedback before you deploy a big change to anything on your site (including plugins and themes!) because they can quite easily break your site, or just give you a load of configuration to do when you thought you were only there for a quick update.