Spam Comments on a Blog Nobody Moderates

Under a post from 2015

Scroll to the bottom of an old post on a small business blog and the comments often begin: great article, very informative, thanks for sharing.

Each comment carries a name, and each name is a link. Further down, the pretence stops: online pharmacies, replica watches, loans approved in minutes.

Nobody at the business has seen any of it. The emails announcing each comment go to an inbox nobody opens.

No person wrote these after reading the post. Programs find comment forms and fill them in by the thousand, looking for forms that publish without anybody approving them.

How spam gets published

WordPress does not publish every comment by default. Spam reaches the page through settings changed long ago, usually for a sensible reason.

• Approval switched off, so early genuine questions appeared at once.
• Trusted names, where one approved comment lets later ones through.
• No spam filter, because the one WordPress includes was never activated.
• Notifications going to a former employee or the original designer.
• Pingbacks, automatic notices from other sites, displayed like comments.

The second explains a great deal. Out of the box, WordPress holds a first comment from a new name for approval, then trusts that name and email address from then on.

So one bland compliment, approved because it seemed harmless, lets through almost everything later posted under that name. And the link in the name does not count towards the rule that holds comments with several links.

What a visitor concludes

A visitor reading about your work, then meeting forty comments selling pills, does not think about spam filters. They conclude nobody looks after the site, and wonder whether anybody reads the contact form either.

Some links are worse than embarrassing: fake pharmacies, phishing pages, downloads nobody should open. The click happens on your page, under your name.

What search engines make of it

WordPress marks comment links nofollow, which asks search engines not to treat a link as your recommendation. The spammer gains little ranking credit, and your site is not vouching for pharmacies.

None of that stops Google noticing. Pages overrun with spam look low quality, and heavy user-generated spam can lead Google to take manual action, which Search Console reports.

Spammers post anyway, because posting by program costs them almost nothing and a few clicks pay for it.

Comments that serve no purpose

Most small business blogs have comments because the theme came with them. If the last genuine comment is more than a year old, comments are doing nothing except collecting spam. Turn them off.

The discussion settings switch comments off for new posts only. Published posts keep their own setting, so close those too with the bulk edit on the posts screen, and switch off pingbacks while you are there.

Media pages, the separate page WordPress can create for each uploaded image, sometimes accept comments as well. And closing comments leaves the existing ones on display, so the cleaning still has to be done.

A worked example

An aquarium store in a Kelowna strip mall started a blog four years ago: care sheets for common fish, setting up a first tank, why a new tank needs weeks before the first fish go in.

Customers asked good questions under the posts in the first year, so whoever built the site switched off approval to let them appear at once.

The employee who answered them left the following year, and the notification emails kept going to her old address.

Then a customer mentioned at the counter that the goldfish care sheet ended in a long column of pharmacy links.

Several thousand spam comments had been published, most of them short compliments with a link in the name.

They were deleted in bulk, and the useful genuine questions were answered inside the care sheets themselves.

Comments are now closed. Each care sheet ends by inviting readers to bring a water sample to the counter for testing.

Cleaning up what is already there

Take a backup first. Then clear the pending queue from the Comments screen in bulk.

The approved comments need reading, not just counting. Compliment spam passes at a glance: vague praise, a name that sounds like a product, and a link attached to that name.

Searching the comments for http finds most of the rest. Where there are tens of thousands, whoever maintains the site can delete them from the database directly, once the backup is safe.

Then check Search Console for messages. If a manual action was applied, request a review once the spam is gone and the settings fixed.

If the comments are worth keeping

Where comments are wanted, approval is the price. Hold every comment until somebody approves it, and activate a spam filter so the queue holds people rather than programs.

Send notifications to an inbox a named person reads, with a regular slot to approve, answer and delete.

Close comments automatically on posts older than a month or two. Discussion happens in a post's first weeks; spam keeps arriving for years.

And answer genuine questions. One left unanswered under a post advertises a business that does not reply.

When the links are not in the comments

Spam links inside the text of posts, in the footer, or showing only on some visits are a different problem. Nobody posted them through a form.

Somebody with access to the site's files or database put them there, so the site has been compromised. Closing comments will not touch them.

The counter-case

For some businesses, comments are part of the point.

A shop whose customers share a hobby, or a practitioner whose readers ask good questions, can build something worth having under its posts. Closing comments there loses a conversation, not just spam.

With a filter and approval switched on, a small blog needs perhaps ten minutes a week. The question is whether those minutes will happen.

Turn comments off where nobody will read them, and hold every one for approval where somebody will.

This week

1. Open the Comments screen and count what is waiting.
2. Read the approved comments on your oldest posts.
3. Take a backup before deleting anything.
4. Delete the spam, keeping genuine comments.
5. Decide whether comments serve any purpose.
6. Close them, or hold every one for approval.
7. Send notifications to an inbox somebody reads.

Step two is the one most owners skip. The pending queue is easy to see, but published spam sits under old posts where nobody at the business looks, and that is what visitors read.

Links that appear where nobody added them are a different matter, covered in hacked sites that redirect only phone visitors.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.