I’ve been looking at my blog comment spam counts lately and although Spam Karma is doing a fantastic job catching 99.9% of them, I’m still having to go in daily and remove 200 - 300 comments caught in my spam traps. Sometimes more.

I’d like to go a layer deeper now and try to stop blog comment spams before they can actually make a comment. Less work for me that way :).

Some tips:

Looking through my Spam Karma data, I can see several IP numbers that are creating huge amounts of comment spam. I’m going to block them from access to SuperAff:

Combating Comment Spam/Denying Access

Below is an example of the .htaccess that is present in the root directory of a website.

order allow,deny
deny from 123.123.123.123
deny from 456.456.456.*
deny from 789.789.*.*
allow from all

deny from 123.123.123.123
Access is denied to that IP alone

deny from 456.456.456.*
Access is denied to ALL users whose IPs start with 456.456.456

deny from 789.789.*.*
Again, anyone at all with an IP that starts 789.789 is blocked.

So a total of 256*256 unique IP addresses are blocked

If you do start blocking IPs, then a blocked visitor will see a 403 error page. Try to make sure that such a page has your contact details listed. Check your hosting to see how to make a custom 403 (or see below too).

If you start blocking IPs with the * wildcard, at least give someone the chance to email you to say you may have made a mistake.

By picking through my traffic logs, I can see some comment spammers access the wp-comments-post.php directly. Let’s give them the boot too:

Deny Access to No Referrer Requests

When your readers comment, the wp-comments-post.php file is accessed, does its thing, and creates the post. The user’s browser will send a “referral” line about this.

When a spam-bot comes in, it hits the file directly and usually does not leave a referrer. This allows for some nifty detection and action direct from the server. If you are not familiar with Apache directives, then write the following in your root directory .htaccess file::

RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !.*yourdomain.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]

I can also see that some old blog posts get hit by spam bots more than most. Some receive hundreds of comment spams a week. I decided to edit the blog posts being hit so that it no longer receives comments. I also slipped a note at the bottom of the blog post that comments were turned off due to comment spam.

I could go the captcha route as well, but I don’t like captcha and I don’t think it’s very effective anyway.

I realize spamming blogs is all fun and games for some webmasters. It would be nice though if they just left our web properties alone and played with their own spaces.