What is the best method to keep bots from spamming your blog?

Question

Hey all!

I got a problem at my blog. I got visits from kind bots who leave "nice" comments to my blog posts :(

I'm wondering if there is a smarter way to keep them out, besides using the captcha modules. My problem with the captcha modules is that I thinks they are anoying to the user :(

I don't know if it's any help to anyone but my site is in asp.net mvc beta.

Answer 1

Have you thought about using this?

http://akismet.com/

From their FAQ

When a new comment, trackback, or pingback comes to your blog it is submitted to the Akismet web service which runs hundreds of tests on the comment and returns a thumbs up or thumbs down.

It's a really easy to use system, which I highly recommend.

Answer 2

I think you have several options...

1. Require registration to post comments - but thats more annoying than captcha, so probably not the best idea

2. Examine the user-agent of the poster (see here) for something that looks genuine or exclude those which look suspect

3. Use a nice Captcha. As annoying as they are, used properly they aren't that bad. It took me 7 attempts to sign up for a gmail the other day because i just couldnt read what it said. A nice captcha though isnt that bad really, kept it short and READABLE

Answer 3

If the spam you are receiving is link-heavy you could assume any comment that contains >= 2 links is a spam comment and not post it to the blog unless the blog author approves them. This is what most comment-spam plugins do. I'm currently working on a blog software and I adopted this solution in the interim until I can integrate akismet fully.

Answer 4

Have a CAPTCHA that is really simple. Perhaps make it always "orange"? I don't think anyone's done that before.

Answer 5

Akismet is definitely the #1 method I know of for limiting spam comments. Also nice to offload that to a 3rd party (at a reasonable price).. that way if client complains, just 'shift the blame'

Another option is to incorporate something like mod_security's spammer signature file. They have a list of keywords you can scan a comment for and place the message to be moderated if you got a match. Though if you had a message board that actually discussed topics that contain these keywords, you'll need a lot of moderators. :-)

Also may want to consider scanning IP's and matching them against SpamHaus or DCShield's block lists. We recently started this approach and it has done wonders.

Things that don't work: requiring registration, simple captcha's, user agent... these can be automated or defeated with cheap labor.

Answer 6

I've had good luck with Honeypots and Hashes.

By making it difficult for robots to post successfully, you can let users post without registration, captchas, or false positives from akismet.

Answer 7

I made spam into someone else's problem by using Disqus to run my blog's comments. There has been no spam since switching, Disqus keeps on top of it.