(bottom of page)
I purposefully didn't start this thread with the title what we do to prevent spam on the forum - it would probably be tempting fate. But I thought some of you may be interested in what we do and suggest other ideas.
Obviously there has been quite a shift in spamming since the recent "revolution" in the abilities of AI. But historically there have been two sources of spam: bots and humans. Bots are getting clever of course, humans maybe not clever but continuing to learn how to get round the spam prevention we have.
First thing a spammer comes across is our registration form because obviously they cannot post unless they are a registered member.
We are lucky in that the forum is relatively small, and is generally between 0 and 5 new members per day, so it's actually possible for admins to see the registration forms as they come in. The form is designed to weed out bots and ideally humans (not quite so easy).
Registration timer. The first line of defence is the time limit - if a form is filled out too quickly it cannot be a human. In our case it is currently 12 seconds so nay forms filled out (automatically) in less than that are rejected.
Next we have the registration fields. Some people think making it too complicated can put off legit users. But I always think legit users understand the reasons and that they are good reasons.
Akismet. I'm sure how this works but I think it can detect AI and also flags up when there is an IP address registration that's the same IP as banned member.
Post moderation queue. All users' first post needs to be manually approved before it goes public. After one approved post people can then post freely unless we are not sure about a first post in which case future posts need approval up until we decide they are bona fide.
Post edit restrictions. Annoying to real members sometimes but stops the very clever human spammers who are good at looking like real members. They may use AI to write convincing posts about the topic even if they know nothing about saxophones. They know about post approval and so think they can get posts past the approval phase , then come back later and edit in a link. Only find they can't edit the post.
Link detection. Any of a user's first five posts that contain a link will go into the moderation queue. Links are what spammers live for.
Account hijacking. This can be a bad one because any user can login with a username or email address plus password. Many users sadly use the same password for several other sites so it just needs another site to get hacked and a spammer has a big database of email addresses, usernames and passwords to go with them. They cannot see our users email address of course but they can just hit the login screen with an automated attempts using either emails or usernames and may strike lucky and get to login as a user who is no longer active. To combat this all accounts that are dormant for over 300 days need to reset their password when they login.
Member reporting. members here are very good at spotting and reporting spam (thank you all). It doesn't happen often but when it does it's helpful to have people reporting. There is also a message "flood" setting as a last line of defence. This means posts cannot be made more frequently than 45 seconds. You may at times find this annoying, but think how much more annoying if a spammer got in and posted 500 messages an hour. People are also good at spotting AI language. again this is useful against the clever spammers who try to get settled in and approved as a real member before unleashing the spam.
Obviously there has been quite a shift in spamming since the recent "revolution" in the abilities of AI. But historically there have been two sources of spam: bots and humans. Bots are getting clever of course, humans maybe not clever but continuing to learn how to get round the spam prevention we have.
First thing a spammer comes across is our registration form because obviously they cannot post unless they are a registered member.
We are lucky in that the forum is relatively small, and is generally between 0 and 5 new members per day, so it's actually possible for admins to see the registration forms as they come in. The form is designed to weed out bots and ideally humans (not quite so easy).
Registration timer. The first line of defence is the time limit - if a form is filled out too quickly it cannot be a human. In our case it is currently 12 seconds so nay forms filled out (automatically) in less than that are rejected.
Next we have the registration fields. Some people think making it too complicated can put off legit users. But I always think legit users understand the reasons and that they are good reasons.
- Blank field. The first "gotcha" is the field that says "leave this blank." Bots are trained to put text in form fields, so anything in that field fails the registration. May be a bit old hat these days though.
- Equipment/gear. This is optional but at least we know if someone puts down some actual saxophones there's good chance this is a legit member.
- Reasons for joining (required). This can weed out human spammers who are sadly very poor people employed by the spam agency. If we see things like "wanna meet people" then this is a good indicator of a spammer.
- The bot question. Bots can do sums, traffic light puzzles and they know what colour the sky is. So it's no longer any use providing that kind of question. We ask for the first three letters of the instrument that the website features, comma separated so the answer is s,a,x. Obviously any human will get that but I don't think bots do. But maybe they do now.
- IP address. Very far from foolproof but when it is combined with location field and automatically generated timezone this is quite useful. If given location is New York, IP is Spain but timezone is Russia then we have an alarm bell. VPNs are common but the time zone is quite a giveaway.
Akismet. I'm sure how this works but I think it can detect AI and also flags up when there is an IP address registration that's the same IP as banned member.
Post moderation queue. All users' first post needs to be manually approved before it goes public. After one approved post people can then post freely unless we are not sure about a first post in which case future posts need approval up until we decide they are bona fide.
Post edit restrictions. Annoying to real members sometimes but stops the very clever human spammers who are good at looking like real members. They may use AI to write convincing posts about the topic even if they know nothing about saxophones. They know about post approval and so think they can get posts past the approval phase , then come back later and edit in a link. Only find they can't edit the post.
Link detection. Any of a user's first five posts that contain a link will go into the moderation queue. Links are what spammers live for.
Account hijacking. This can be a bad one because any user can login with a username or email address plus password. Many users sadly use the same password for several other sites so it just needs another site to get hacked and a spammer has a big database of email addresses, usernames and passwords to go with them. They cannot see our users email address of course but they can just hit the login screen with an automated attempts using either emails or usernames and may strike lucky and get to login as a user who is no longer active. To combat this all accounts that are dormant for over 300 days need to reset their password when they login.
Member reporting. members here are very good at spotting and reporting spam (thank you all). It doesn't happen often but when it does it's helpful to have people reporting. There is also a message "flood" setting as a last line of defence. This means posts cannot be made more frequently than 45 seconds. You may at times find this annoying, but think how much more annoying if a spammer got in and posted 500 messages an hour. People are also good at spotting AI language. again this is useful against the clever spammers who try to get settled in and approved as a real member before unleashing the spam.
Last edited:
