Linux and PHP web application support and development (Bromsgrove, UK)
November 22, 2012, palepurple, systems administration, wordpress, , 0
One customer has a forum which has been consistently plagued by spam – here’s a short writeup about what we found worked for us in an initial attempt at reducing the tidal wave of spam.
The obvious initial caveat is that whatever measures may be detailed within this post are unlikely to be applicable for other scenarios – spammers change tactics.
The site in question runs a WordPress based forum (bbpress) and receives a relatively high level of traffic (due to which, it’s presumably a tempting target for spam postings).
The forum was protected by Akismet, however even with Akismet, an unacceptable level of spam was getting through (Akismet reports that it’s stopped 106,000 spam in the last few weeks).
Initially we :
Based on the above, it was obvious that :
While initially it was tempting to go for the quick ‘kill’ and block subnet’s of users using an iptables rule, this wasn’t ideal as it could block legitimate users. The idea of having to maintain this pool of IP addresses wasn’t something to look forward to either – we’d need some way of identifying disreputable IP addresses/clients and automatically blocking them (perhaps with fail2ban in the future).
From experience with tools like SpamAssassin in the past, it seemed most sensible to adopt a scoring strategy with submitted posts – so, for example, we’ve added rules like the following :
Given enough rules, and a reasonable threshold, the chance of wrongly identifying/tagging a post decreases. Now, if the post score is above a specific threshold (e.g. 5) we discard the request returning a non-descriptive error message.
We’ve implemented the request processing before the forum code itself runs/loads, and to minimise overhead, we only check HTTP post requests.
Appropriate logging of requests and data has allowed us to tweak the ruleset over the last 24 hours, to the extent that from a 12 hour period, we’ve identified 3501 spam comments, had one spam posting get through by mistake (which led to a rule update, and was caught by Akismet anyway) and so far, no false positives.
We’ve no intention of replacing Akismet – as it does an excellent job – but certain requests seemed to be easy to target – and by blocking them we can make a significant difference to the site’s performance and users.
akismet, bb-press, php, spam, wordpress
‹ VCi Android application – completed Kashdroid – a kashflow client ›
Copyright Pale Purple Ltd 2006 - 2013. Pale Purple is a trading name of Pale Purple Limited, Registered in England and Wales (Registered No. 5580814)