Sometimes simple is better.
Since 2011, I have painstakingly identified and compiled over 42,000 phrases, patterns, and keywords commonly used by spammers and comment bots in usernames, email addresses, link text, and URIs. As with all compilations, this blacklist is a work in progress and there will always be room for improvement and optimization.
Suggestions and bug reports are certainly appreciated. Please use the issue tracker to let me know.
Repeat this procedure each time you want to install an updated version of the blacklist.
Automatic Updates Via Plugin
If you prefer a more hands-off approach, there are several plugins that will check whether the master blacklist has changed and then automatically install the most recent version. How handy is that?
I don’t blame you if you’re skeptical about how well this blacklist works compared to a commercial solution like Akismet. Because I am subjectively including keywords based on comment spam submitted to my own sites, there is a chance that the blacklist will “overclean” your comment queue.
Consider that fair warning.
However, Jason Cosper reports that he used an earlier version of the blacklist on a client’s WordPress installation containing 800,000 or so comments. The blacklist flagged 40% of those comments as “spammy”. As a sanity check, he then exported those flagged comments to a local WordPress install and subsequently had Akismet do its thing. According to Jason, there were “zero false positives.”
WordPress stores the contents of the Comment Blacklist setting in the options table as
blacklist_keys. Defined as a
longtext data type, this MySQL column can contain up to 4,294,967,295 bytes (approximately 4GB) of text. There is no chance of us running out of room to expand the blacklist any time soon.
There has been some talk about storing the
blacklist_keys option in an entirely separate table.
As mentioned above, the keywords in the blacklist are based on spam submitted to my own sites. Spammers often utilize the obscuring capabilities of URL shorteners to hide their nefarious links. Therefore, I have included a handful of URL shortener domains in the blacklist. For all practical purposes, there’s no need for a comment to include a shortened URL, as unmodified links can be easily formatted using HTML. If you find that your visitors are using shortened URLs on a regular basis, you may wish to remove some or all of these domains from the blacklist.
Spammers will also utilize links that include URLs that are specific to WordPress installations. These links often point at compromised admin files, themes, or plugins. In most cases, there’s no need to include a URL that deep-links into the bowels of a WordPress site. However, you may want to remove the following keywords from the blacklist if your visitors are commenting on topics related to WordPress site, plugin, or theme development.
This blacklist has been created for use on English language sites. There are several dozen terms and phrases included in the blacklist that may flag legitimate comments posted in other languages. If you commonly receive comments in other languages (specifically those containing Chinese, Japanese Hiragana and Katakana, Korean, Thai, or Cyrillic characters), you may want to remove or modify those sections of the blacklist.
HTML Tag Attributes
The blacklist is not applied against HTML tag attributes found in comments, only the values assigned to those attributes. This means that you cannot include the attribute name, equal sign, or the quote marks as part a keyword. For example, the keyword phrase
title="Discount will not match anything, even if that exact bit of text exists within the content of an HTML formatted comment. A keyword consisting of
Discount should be used instead. Other HTML attributes commonly allowed in WordPress comments such as
datetime are also ignored.
User Agent Strings
According to the WordPress Discussion Settings Screen documentation, a comment will be marked spam if any of the Comment Blacklist keywords are found in the comment content, name, URL, email, or IP address fields. Surprisingly, WordPress also applies the blacklist against the user agent string.
For example, an earlier version of the blacklist contained the keywords
/5. to flag URLs with sequentially numbered pages with various file extensions. Unfortunately, these two benign-looking keywords also flagged comments containing common user agent strings, such as
Chrome/5.0. In other words, nearly every single comment was flagged as spam, regardless of its content or whether the commenter had been previously approved.
Since the blacklist is applied to commenter’s IP address, we need to be aware of strings that might match seemingly generic, but valid addresses.
For example, in an earlier version of the blacklist the keyword
:: had been included, as it appeared occasionally in mangled comment text and URLs. However, double colons are also part of the IPv6 localhost IP address
::1. If you happened to be testing a WordPress installation on a system using IPv6 addresses, every single comment would have been flagged as spam.
“So much for using Akismet.”
Thanks to Mika Epstein, Ben Gillbanks, Paul Goodchild, Sergej Müller, Andrew Norcross, Fabrizio Salmi, Volker Schmidt, and Claudio Schwarz for their various contributions, suggestions, and reports from the field.
Likewise, Chris Burton deserves a virtual fist bump for the above quote.
I’d also like to acknowledge John Hughes, Paul Taubman, Christina Robinson, My Brain Lounge, Roger Williams Media, eComStyle.de, FliegenToeter, WPCoder, Nguyễn Đình Quân, and Torque for mentioning and linking to this project.
Copyright © 2011–2021 Grant Hutchinson
This project is licensed under the short and sweet MIT License. This license allows you to do anything pretty much anything you want with the contents of the repository, as long as you provide proper attribution and don’t hold anyone liable.
See the license.txt file included in this repository for further details.