How I block comment spam

July 19, 2005

You would think that by having custom written blogging software (only two other blogs out there are using this code), and not allowing HTML in comments, that comment spammers would not waste their time on me. But they do.

Why do they bother with me?

Even though their URL will not be hyperlinked on my blog giving them pagerank, they still spam because they are hoping for the following:

  • They want me to click on the link before I delete it.
  • They are hoping that people subscribed to the comment thread will click on the link.
  • They are planting keywords on my pages so that someone searching for the term in google, may find my page, and copy and paste the url.

When I was at the bloggers BOF at cfunited, people mentioned that when using Ray Camden's blog CFC software they didn't get much if any comment spam. I think that is because the comment form is located in a popup window launched by javascript. So it's more of a hassle for spammers to spam them. I however would rather keep my comment form on my entry page, so it's easier for readers to post comments.

What I do to block comment spam

Here's what I do to block comment spam on this blog:

  • Check HTTP Referrer to make sure it's coming from my site. I know some people like to turn this off in their browser, but they won't be able to post comments unless they turn it on.
  • If the comment contains a HTML link I reject it, giving the user a detailed message that tells them to just post the url.
  • Check for a set of bad words - my list is very small only about 10 words currently.
  • Check for [url] - a lot of comment spammers try to pass the links as [url]http://foo[/url]
  • Look for more than 5 url's in the comment. Comment spammers often try to post 10-20 urls at a time, so I just reject them. I use this regular expression REFindNoCase("(http:.*){5,}", form.comment)

Related Entries

14 people found this page useful, what do you think?


I think you are probably right about the pop-up. I've only had one comment spam in the past 6 months on my blog hosted on blogger.
I was having the problem as well (using my own custom Blog software.) I fixed this by building a simple spam filter. When I get a piece of spam, I move it to a spam filter table. All my spam was coming in from basically the same e-mail address and the same Urls, so my filter basic looks to see if these is a bad comment and if so silently rejects it. While I was getting a handful of spam messages a week, I've dropped down to zero.
A small modification to your regex to deal with https and to make it non-greedy. REFindNoCase("(https?://.*?){5,}", form.comment)
You should NEVER be checking the HTTP_Referer. Your assumption that you are preventing only those valid users who know how to change/spoof their HTTP_Refer is grossly mistaken. You are hindering many valid users who have installed software that supposedly protects their privacy by hiding this info. There are quite a number of software suites that change or prevent reporting of the referer. Granted, this is stupid and pointless effort by these software vendors and they have done things to break stuff on the web in other ways as well, but it is something users likely do not have the knowledge to fix and creates unsuspecting victims rather than the techie tinkerer that you envision who knows why he can't post. The #1 goal of any measure to prevent malicious use should be to not hinder the legitamate user, which your solution does indeed. I use some other methods like datetime-generated stamps cross-checked with a salted hash to disallow someone from ripping my form off and submitting from another location. Of course if they scrape the page in real-time, that is the hardest trick to defeat, but then you can do things like freqeuency capping, mass deletions, or other means of authentication (captcha, email verify if not logged in).
I have been looking for sites like this for a long time. Thank you!
I have been looking for sites like this for a long time. Thank you!
I visited your web site.
Thank you for your site. I have found here much useful information...
Write your comments here, please.
Crosby leads the in points and assists and is near the top in goals.
I want to say - thank you for this!
Thank for making this valuable information available to the public.
very helpful, thanks!n
Very good web site, great work and thank you for your service.+
excellent texture.l
simple but quality, thanks!d
Thank for making this valuable information available to the public. forex ?????
While I did get some good's funny to see that this page has been spammed quite a bit. Pretty much everything after Oct 20, 2006 is junk.
Apple Inc.'s new data synching service got off to a rocky start Thursday, as some users were denied access to their accounts just hours before the next-generation iPhone is slated to go on sale.
H0QzIh Thanks for good post
Totally Awsome!
Totally Awsome!
Thanks for the good information.

Pls tell me where to place that code in Word press sites
It's really glad to read about the following topic which has

enhanced my knowledge regarding topic and plus has given

alot of ideas which I can think on.
So I would say thank you to the blog owner for providing

this amazing information.
hi there stevo if you are still in need of them i think this is the contact
and some info , there very helpfull ,tell them micky h give you there number

Recent Entries