This aside, one of the big problems you will come up against when administering a “default” wordpress installation is comment spam. Basically you will see hundreds of comments on your posts pile up, but when you actually have a look at those comments you will quickly realize that almost all of them will be essentially from bots that attempt to spam your posts with links. But you can avoid this with a few very simple steps that will stop the spammers dead in their tracks.

WordPress Settings

The relevant settings can be found by logging into your WordPress instance as an administrator, then from the Dashboard going to Settings > Discussion.

Default post settings

The first thing to do is decide whether you want to allow comments on your posts at all. It’s not as obvious as thing as it might seem. If you try to measure engagement by relevant comments on WordPress, you will likely be very disappointed. A much better measure of engagement is how much discussion you can generate on social media sites on which you share your posts. So, the easiest way to cut down on spam is to disable comments entirely by unselecting the checkbox next to  Allow people to submit comments on new posts and skipping the rest of this article.

Other comment settings

If you do allow comments, the most effective way to cut down on the amount of spam is to select Users must be registered and logged in to comment in this section. Spammers are just not going to go through the trouble of registering as a user and will just skip your site, which is the best scenario.

Before a comment appears

Unless you expect that your blog will be a particularly busy one in terms of users comments — and in 2026 that is not a very likely eventuality — make sure to select both the Comment must be manually approved and Comment author must have a previously approved comment options. These will make sure that spam comments do not appear under your posts by default. I believe that those are the default settings in WordPress, but you’ll want to double-check.

Comment Moderation

At this point your installation is already pretty secured, but to “bulletproof” things you should change the Hold a comment in the queue if it contains X or more links option to 1 instead of the default 2.

Conclusion

Just adjusting your WordPress settings in the ways described above should cut down the spam submitted to your site by 99%. Sure, having a large number of comments on posts may seem encouraging if you’re starting a new project, but what you really want is engagement, not people using your site to advertise (mostly) porn and other questionable sites. And in my experience the engagement will actually come from the forums and social media sites on which your share your posts, and not those left on your site.

Thanks for attending my TED talk…

The post Killing WordPress Comment Spam for Fun and Profit first appeared on The Clever Shark.

The post A fresh look? first appeared on The Clever Shark.

The post Back… for now first appeared on The Clever Shark.

The post Blog update first appeared on The Clever Shark.

1. I should update WordPress more frequently. Until yesterday I was using a version that apparently enabled a third-party to add a bunch of spammy text at the end of pages (the usual “buy meds quick” crap), so that my Google ads were all for shady online pharmacies.
2. Google Adsense. I’m not impressed, I’m really not. You have the option of blacklisting target sites in the Adsense interface, but that blacklist doesn’t seem to be in use at all, as ads for blacklisted sites still appear even though those sites have been on my blacklist for months. And it’s going to be a while before the damage is undone, so I’m afraid it’s Amazon ads for now.
3. Another weak point for Adsense and Google in general — it’s supposed to be able to identify SEO cheats like the “spam attack” on my site, and those certainly matter when it comes to page rank. However Google AdWords clearly makes a mint selling ads to companies that make products that are chiefly advertized through spam (like shady meds). How motivated is Google to identify such blatant gaming of their AdSense system? Not a hell of a lot, apparently. If anything by ignoring factors it is itself aware of Google seems to be encouraging site hijacks of that nature by making them profitable.
4. What’s more, Adsense’s byzantine generated links make it difficult to identify the site a Google ad links to. It’s important if you want to add a site to the blacklist that doesn’t work. But don’t click on your own ads because this will lead to your being kicked out of the program without notice, explanation, or any form of appeal.
5. Google Analytics. I am impressed by the data it provides, but I learned that it doesn’t work if you insert it into your code after the </body> tag. I really can’t blame anyone but myself for this goof. It’s a bit of an embarassing mistake to make, really… if you have WordPress, make sure you insert the script tags in the cshk_footer() function before closing the body tag! To paraphrase The Simpsons, “Don’t do what Tony Don’t does!”
6. Against all odds it appears I have some traffic! Yay!

The post Things I have learned recently… first appeared on The Clever Shark.