How to stop spam in comments

Question

I've installed reCAPTCHA module but spam still bypass my security and leave nasty comments. What should I do? How to block them?

Answer 1

I had a good experience with the Mollom module, but a free registration is required for your site. Unfortunately, Mollom has announced the end-of-life for their service. Acquia support and maintenance for Mollom ended as of April 2, 2018.

I really like the Antibot module: It's lightweight and pretty effective.

Answer 2

Mollom is a very useful tool for preventing spam and integrates well with Drupal and is an essential module for running a Drupal site which can get reasonable traffic.

AntiSpam is also another spam prevention module for Drupal based on Akismet of Wordpress, but you need to have an Akismet account for it to work.

You could also try the following suggestions to bring in an additional level of spam protection.

If you are running memcache and if you are not worried about regular users posting to your site now and then, you can use the following trick.

You can add PHP code in your settings.php file to filter out anonymous users who are trying to use 'POST' to paste comments within a period of say '5' seconds from the same IP address and preventing them from posting again. Very useful against bots.

if ($_SERVER["REQUEST_METHOD"] == 'POST' && !isset($_COOKIE['DRUPAL_UID'])) {
  $m = new Memcached();
  $m->addServer('localhost', 11211);
  $key = 'anon_'. $_SERVER['REMOTE_ADDR'];
  if (!$m->get($key)) {
    $m->set($key, 1, 5);
  }
  else {
    $m->set($key, 1, 5);
    echo ("We are sorry, there was an error processing your submission. Please try after some time");
    exit;
  }
}

The code creates a key in memcache which will act as a decaying flag for finding out whether a user has been posting comment to the site in the last 5 seconds.

For more details check out this article.

Another strategy would be to detect non english spam comments with more than 3 links. You can use the PEAR language detection library to filter out comments that are not in English or have more than 3 links which are typical of spam comments. This one requires a bit of coding skills and you need to write a custom module. For more details check out the article by the forementioned link.

Answer 3

Another module that does a pretty good job with spam comments (depending on your site) is Honeypot, a project I created, for which I am one of the maintainers and the project owner.
It will also help prevent user registration and form spam.

The module has releases for Drupal 7, Drupal 8, Drupal 9, and Drupal 10. Out of the alternative modules suggested in its project page, this is the only module that declares to be compatible with Drupal 10.

Answer 4

Try to use the ASCII art CAPTCHA the CAPTCHA Pack module makes available. It helped me in bad times.

Answer 5

Here's a quick and easy method that has pretty much gotten rid of all my spam comments. It stops comments with embedded links from being posted by anonymous users.

// hook comment creation
function THEME_OR_MODULE_NAME_form_comment_form_alter(&$form, &$form_state, $form_id) {
  $form['#validate'][] = 'THEME_OR_MODULE_NAME_comment_exclude_spam_with_link';
}

// function to weed out spam comments with links submitted by anonymous users
function THEME_OR_MODULE_NAME_comment_exclude_spam_with_link($form, &$form_state) {
  $comment_body = $form_state['values']['comment_body'][LANGUAGE_NONE][0];
  if (isset($comment_body['format'])) {
    $comment_text = check_markup($comment_body['value'],$comment_body['format']);
  }
  else {
    $comment_text = check_plain($comment_body['value']);
  }
  if(preg_match("/href=/i",$comment_text)) {
    if(isset($_SERVER['REMOTE_ADDR'])) {
      $user_ip = $_SERVER['REMOTE_ADDR'];
      if(!user_is_logged_in()) {
        $watchdog_message = "Attempted anonymous link, IP: " . $user_ip;
        watchdog("content",$watchdog_message,NULL,WATCHDOG_ERROR);
        form_set_error('comment_body', t('Embedded links are not allowed for anonymous users'));
      }
    }
  }
}

There is a watchdog message that you can use to ban the IP address if you wish. This code goes in a custom module or the template.php file for your theme. I'm using a module as this is functionality only. Replace THEME_OR_MODULE_NAME with the name of your theme or module.