I'm managing a number of servers with dozens of Drupal sites, some with a single multi-site Drupal installation and others with dozens of separate Drupal installations. We're constantly running into the issue of one site having a lax registration or comment policy and getting overrun with node spam to the detriment of the entire server.

Addressing the spam isn't a problem once we can detect the issue (CAPTCHAs and user registration approval usually knock out most of the attacks) but most of these sites have inexperienced administrators who aren't savvy enough to notice these attacks underway and we only detect them several months in when the damage to performance and SEO has already been done. Better security policies would also obviously help and we usually try and address any potential security issues during the site build but we don't usually try and prevent the client from enabling comments or adding new features, etc.

Any recommendations for how to monitor multiple Drupal sites to detect an attack like this before it gets too far? I've seen a number of 'drupal watch' modules and services like Drupalmonitor.com or NewRelic but they seem more focused on module updates, etc. Possible signatures for a spam attack would probably be an excessive amount of comments or nodes over a given period, coming from the same server, excessive load on a specific table, etc.

1 Answer 1


ether try the free mollom service or you can blacklist words before they get submitted. Another solution that does well is just use the disqus module to regulate your commenting. i have switched over to disqus completely. but its not seo friendly as its a js script call from what i remember. if you want seo capability best you blacklist words and links. say if someone posts a link it would throw an error. this would deter any link spammers as most bots posts links.

  • thanks for the reply - mollom and disqus are excellent response options but my problem/question is more aimed at how best to detect these issues across a large number of sites. The assumption for most of these sites is that they aren't enabling comments or soliciting user-generated content when we create them but at some point in their lifespan, an admin user might add this functionality without our knowledge which can have performance / security implications for the entire box. I'm trying to come up with a way of detecting when that happens..
    – schnippy
    Jan 29, 2013 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.