Dealing With Comment Spam¶

Quickstart¶

If you're having trouble with comment spam, you should:

• Enable reCaptcha either on a specific page or ask ActionKit support to enable it site-wide.
• Verify the Akismet Check is enabled.
• Check the Spam Check Log, adjust the Threat Score up or down.
• Enable Suppress Actions and Unsubscribe Users.
• Check the Spam Check Log daily, then weekly to make sure you aren't catching legitimate users.
• Report any bugs!

reCaptcha¶

reCAPTCHA blocks actions from bots more effectively than a spam filter can, and can be enabled page-by-page or sitewide.

ActionKit's captcha support is provided via Google's reCAPTCHA service. A page that has captcha tests enabled will show a small reCAPTCHA logo in the bottom right corner. ActionKit invokes the "invisible captcha" mode, which attempts to recognize "trustworthy" users and allows them to bypass the captcha challenge altogether; other users will be presented with a captcha challenge when they submit the action form.

Read more about how to implement reCAPTCHA.

"Trial Mode"¶

If you notice a spam problem, and want to start using this feature, you may want to start with it in a "trial" mode to make sure that it's configured properly, so that it catches actions that are spam, and doesn't catch ones that aren't.

• Enable spam checking, but don’t enable suppression/unsubscribes.
• Let that run for a few days during which you regularly review the spam check log.
• Check to see whether the spam check is overly aggressive, or is not aggressive enough -- eg, is it missing obvious spam actions, or is it incorrectly flagging non-spam actions -- and tune the spam-check settings to be stricter or looser as needed.
• Manually suppress and/or unsubscribe actions that you find flagged as spam during this time.

When you feel good about the spam check settings, turn on the site-wide automatic suppression and unsubscribe options. Then come back to the spam check log occasionally to check to see if there are items that got classified as spam that shouldn’t have been, and un-suppress them if needed.

More Details¶

You can set the spam checks to Suppress Actions, Unsubscribe Users or both.

The tools include three checks: Akismet, IP, and Content. You can manually enable each check on the Configuration screen.

Spam checking does not create blocks or bans on IPs or email address, because spammers rarely use the same email address or multiple times. You may manually add an IP to the IP Check Block List if you are sure it is a source of spam.

It may occasionally be useful to block specific IPs or set up a narrow Content Check for a short period of time.

How Spam Checking Works¶

Spam checking works by looking at Actions after they have been validated and saved, but before we send out confirmation emails or petition signatures. Any actions that the checks find suspect will be saved to the Spam Check Log. If you've enabled Suppress Actions, actions will be marked as spam, and confirmation, tell-a-friend and signature delivery emails will be suppressed. If you've enabled Unsubscribe Users, the user will be immediately unsubscribed.

Spam checking has a time limit when run during action processing. A second pass - with no timeout - occurs offline every few minutes.

You can review spam checked actions in the Spam Check Log

The columns listed are:

• timestamp - the datetime the action was submitted
• check - the name of the spam check that "caught" this action
• email - the email of the user who submitted this action, linked to the user's record
• user comment - the value for the comment custom action field
• outcome - whether this action was automatically suppressed or not, was in the allow list, or marked not spam by staff

If you click on any of the rows in that table, they'll toggle open, revealing some additional information:

• page - the title of the page, linked to the page editor
• allowed - you'll see a green checkmark if a spam checks' allow list matched this action, most entries will have a little red icon meaning they were not in the allow list.
• why - what the check found that triggered a match
• reversed - if you've overridden the spam checking, this will be true and you'll see a little green checkmark.
• reversed_at - the datetime when an admin restored this action and resubscribed the user
• actions - use the "Not spam" button to mark the action as complete and to resubscribe the user. "This action matched spam filters, but was not suppressed" means the action looks like spam, but the Suppress Actions configuration option was not enabled when this log entry was added. In that case, use the "Delete this action, it's spam" button to delete that spam action.

The log entries are sorted from most recent to least by default.

The user page will also display some information for users who have been marked as comment spammers. Their subscription status will be:

Unsubscribed for Comment Spamming since Wed Mar 11, 2015 Resubscribe Resubscribe and restore actions

Select Resubscribe to resubscribe the user, but leave their actions as spam. Use Resubscribe and restore actions to resubscribe the user and restore all of their actions.

Spam Checks¶

You can configure spam checking on the Config page. Each spam check can be enabled and configured independently. By default, spam checking will not modify any actions or users.