Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are anti-spam measure I should consider before launching my user content website? Some things I have considered:

  • Silent JavaScript based CAPTCHA on the register page (I do not have an implementation)
  • Validate emails by forcing a confirmation link/number
  • Allow X amount of comments per 10 minutes and Y per 2 hours (I am considering excited first time users who want to experience the site)
  • Disallow link until user is trusted (I am not sure how a user will become trusted)
  • Run all comments, messages, etc. through a spam filter.
  • Check to see if messages are duplicate or similar (I may not bother with this. I'd like the system to be strong without this)
  • I also timestamp everything which I then can retrieve as a long on my administrator page.

What other measures can I take or consider?

share|improve this question
  • Captchas, Stack Overflow/Server Fault combine these with rate-limiting well. Basically if you take too long to post a question, or edit to often, you have to enter a reCAPTCHA code.
  • Askimet - basically a "global" Bayesian spam filter, you submit content (comments, usually) via their API, and it says if it considers the content spam or not.
  • Regarding disabling linking until you "trust" a user - it depends on the type of site, but perhaps enable linking after 24 hours, or until their content gets an upvote or a reply - that should limit many of the automated register-then-spam bots.
share|improve this answer

I'm surprised to see you're not already considering using reCAPTCHA.

share|improve this answer
oops. I forgot to say i was. But as a first line of defense i want to see if a silent captcha using a honeypot technique will work. – acidzombie24 Jun 9 '09 at 14:35

That list is a good start, but here are some additional suggestions:

  1. Listen to the Stack Overflow podcast. Joel and Jeff had extensive discussions about how they approached this problem and you will learn a lot from their experience on this matter.

  2. Consider making your CAPTCHA appear only when the application detects something odd going on. Having it display by default will annoy the legitimate users.

  3. Having a CAPTCHA powered by JavaScript is one of the lease secure ways of doing it. I would recommend something generated on the server instead.

  4. Depending on the nature of the content, allow the community to flag offensive of spammy content. If it reaches a certain level of reports, it can be disabled automatically.

share|improve this answer
I wouldn't really worry about how easily broken it is, CAPTCHA's are only good for cutting the most rudimentary bots off nowadays. OCR and Human Contracters make even pretty advanced CAPTCHA's from sources like MS and Google breakable a good precentage of the time. – user5401 Jun 9 '09 at 13:53
True, but I see JavaScript driven CAPTCHA in the same light as anti-right click scripts and the like. They're almost worse than useless since the site operator might have a false sense of 'security' if they don't know what they're doing. – Justin Scott Jun 9 '09 at 14:11

I suspect that excited users who want to explore the site are going to have a different pattern of use from a spam bot that tries to register an account and post a spammy link or two on every forum or blog comment box it can find before jetting off.

As such, you can consider applying rate limiting more aggressively to things that meet that pattern - people experiencing a new site might post a lot but its probably going to be centred around things that interest them. Considering a Linux expert joining if you like... they might post very aggressively in threads related to Linux and products that commonly run on top of it, what they won't do is post one or two comments to every darn thread they can regardless of interest.

Oh yeah, and +1 for the suggestion to look at the stack overflow podcasts where this has been discussed. I might add taking a look at what other sites you consider successful in this regard are doing can be invaluable. You don't have to copy google or amazon or stack overflow in order to learn from their mistakes and successes.

share|improve this answer
  • Besides links also prevent inline content such as images from being posted until "trusted" (or never allow it). Allowing inline images leaves you open to having to worry about CP.
  • Depending on your audience, text filters for swear words/offensive content
  • Filter on IP to prevent duplicate account sign ups, and/or rate limit account sign ups
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.