Comment Spam and Malware

If you’ve been on the internet for any amount of time you’re probably familiar with “spam” in your email inbox.

Well just like you can get spam messages in your inbox, people will leave spam comments on your blog. However unlike email spam where the target is you, comment spam generally targets search engines. It may surprise you to learn that we consider spam to be a website security function.

Almost immediately after you launch your first website, you’ll notice comments appearing that are garbage, with links to websites that are filled with junk. Welcome to “comment spam”. To help filter out comment spam, we recommend two plugins for your CMS-System:

Antispam Bee – This plugin does a great job of helping filter out comment spam automatically and will reduce your workload.
Wordfence – This security-plugin includes a few additional spam filtering features that will automatically flag comment spam and categorize it into the spam folder.

Once you have automatic spam filtering set up, you will unfortunately discover that some spam still gets through the filters and you need to manually filter it.

Develop a Manual Spam Filtering Policy

We recommend following these guidelines:

Don’t allow comments that include any embedded code or javascript. Usually this is not allowed and should be filtered out by your CMS-System, but vulnerabilities sometimes appear that allow code like this through. If you see code, just flag it as spam unless you are running a developer website and want to allow your commenters to include code samples.
Trust comments that don’t include a site URL more than those with a URL. In general, spammers will always include their site URL with the comment. Real commenters do the same thing, but in general when you see a comment with no URL, it means that whoever posted it is not at all interested in self-promotion and you’ll rarely find spammers that aren’t interested in that.
Don’t allow comments in a language you don’t understand. For some reason we have a problem with Chinese comments getting through our spam filter. We don’t know what the comment is saying, if it contains politically sensitive speech or if it contains adult content. Filter these out.
Consider carefully a comment with many URLs. Usually these are typical of spam comments and there are few legitimate reasons to include a large number of URL’s in a comment.

Check your Comment Settings

In your CMS-System, go to the comments-section and you will find the settings that govern your comment policy. Here are a few helpful suggestions:

You may want to disable pingbacks and trackbacks. This can be a common source of spam, and unless you want links automatically added to sites that link to you, disable this feature.
Enable allowing people to post comments on new articles. This keeps things lively.
Require that the comment author fill out name and email.
The feature to “automatically close comments” more than a number of days old is great to reduce your spam-filtering workload. Most comments on a post or page will appear within the first few days and then trickle down to nothing. However, watch how your site visitors behave. We have seen pages that become a kind of ‘forum’ about a particular subject and if you don’t mind filtering out spam comments on older posts, this can be a great way to have your user community keep contributing valuable content to your site.
You probably want to receive an email whenever a comment is posted, unless your comment traffic is very heavy and you are signing in daily.
Holding a comment if it contains one or two links is a useful feature because spammers usually include links in the comment body.

Review your comment settings carefully, develop a policy that matches your website and community needs and that helps limit spam.