I've installed reCAPTCHA module but spam still bypass my security and leave nasty comments. What should I do? How to block them?


I made good experience with Mollom. But you need a free registration at their site.

Update: Unfortunately Mollom has announced the end-of-life for their service by April 2018.

Update 2020: I really like the antibot module. It's lightweight and pretty effective.

  • +1 for Mollom. Doesn't hurt that it was founded by Dries, who also created Drupal :-) – Garry Jan 10 '13 at 13:59

Mollom is a very useful tool for preventing spam and integrates well with Drupal and is an essential module for running a Drupal site which can get reasonable traffic.

AntiSpam is also another spam prevention module for Drupal based on Akismet of Wordpress, but you need to have an Akismet account for it to work.

You could also try the following suggestions to bring in an additional level of spam protection.

If you are running memcache and if you are not worried about regular users posting to your site now and then, you can use the following trick.

You can add PHP code in your settings.php file to filter out anonymous users who are trying to use 'POST' to paste comments within a period of say '5' seconds from the same IP address and preventing them from posting again. Very useful against bots.

if ($_SERVER["REQUEST_METHOD"] == 'POST' && !isset($_COOKIE['DRUPAL_UID'])) {
  $m = new Memcached();
  $m->addServer('localhost', 11211);
  $key = 'anon_'. $_SERVER['REMOTE_ADDR'];
  if (!$m->get($key)) {
    $m->set($key, 1, 5);
  else {
    $m->set($key, 1, 5);
    echo ("We are sorry, there was an error processing your submission. Please try after some time");

The code creates a key in memcache which will act as a decaying flag for finding out whether a user has been posting comment to the site in the last 5 seconds.

For more details check out this article.

Another strategy would be to detect non english spam comments with more than 3 links. You can use the PEAR language detection library to filter out comments that are not in English or have more than 3 links which are typical of spam comments. This one requires a bit of coding skills and you need to write a custom module. For more details check out the article by the forementioned link.

  • Nice answer buddy. Going to try this sometime. – AKS Jan 11 '13 at 21:00

Another module that does a pretty good job with spam comments (depending on your site) is Honeypot. It will also help prevent user registration and form spam.

  • 1
    A little success story: got 20-50 spam registrations per day, installed Honeypot and now have 0 spam registrations for 2 days already. Got to update this after some time, though: may be they will breach the protection after some time. – YakovL Oct 31 '16 at 14:08
  • Ok, 0 bots after a week, too. – YakovL Nov 5 '16 at 18:29

Try to use the ASCII art CAPTCHA the CAPTCHA Pack module makes available. It helped me in bad times.


Here's a quick and easy method that has pretty much gotten rid of all my spam comments. It stops comments with embedded links from being posted by anonymous users.

// hook comment creation
function THEME_OR_MODULE_NAME_form_comment_form_alter(&$form, &$form_state, $form_id) {
  $form['#validate'][] = 'THEME_OR_MODULE_NAME_comment_exclude_spam_with_link';

// function to weed out spam comments with links submitted by anonymous users
function THEME_OR_MODULE_NAME_comment_exclude_spam_with_link($form, &$form_state) {
  $comment_body = $form_state['values']['comment_body'][LANGUAGE_NONE][0];
  if (isset($comment_body['format'])) {
    $comment_text = check_markup($comment_body['value'],$comment_body['format']);
  else {
    $comment_text = check_plain($comment_body['value']);
  if(preg_match("/href=/i",$comment_text)) {
    if(isset($_SERVER['REMOTE_ADDR'])) {
      $user_ip = $_SERVER['REMOTE_ADDR'];
      if(!user_is_logged_in()) {
        $watchdog_message = "Attempted anonymous link, IP: " . $user_ip;
        form_set_error('comment_body', t('Embedded links are not allowed for anonymous users'));

There is a watchdog message that you can use to ban the IP address if you wish. This code goes in a custom module or the template.php file for your theme. I'm using a module as this is functionality only. Replace THEME_OR_MODULE_NAME with the name of your theme or module.


The simplest and most efficient way of preventing spam in comments (and also in webforms and contact forms) is to use the Block Anonymous Strings module. You can define your own regular expression strings to check and block submissions against.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.