Thanks for sharing, actually this plugin doesn’t help to block the bot or spammer who is trying to post a comment. Using nonces will help to keep your comment waiting list clean, but the file wp-comments-post.php is still executed and the load on your server is still high if many posts are done. Our approach is not just about filtering spam, but more to use less resources while offering a comment function.
I like Google reCAPTCHA. Seems to stop everything!
CAPTCHA challenges are an option, but they are also an challenger for the visitor who will post a comment for real.
(Akismet developer here.) When you say that Akismet leaves “garbage comments” in the database, what do you mean?
Part of the problem with that concept is that they don’t really define what they consider a “commercial” website.
“Commercial” is any site that is used for commercial purposes. Selling products, promoting a business, or driving ad revenue are all examples of commercial purposes.
The strictness setting that we added last year allows you to have Akismet auto-delete the most obvious spam, which is usually about 80% of spam comments.
Hi Chris, thank you for clarifying that unless a site is 100% revenue free, it’s commercial in your eyes. My first, and somewhat abandoned blog, apparently still has Akismet installed; more on that in a moment. I will take the appropriate action but, I’ll leave it installed for a few days in case you would want more details about my comments below.
While this post is a bit of an attack on Akismet, our point was primarily that folks should not rely on a single tool to defend against spam. Your plugin comes installed on WordPress. It seems a natural place to begin any discussion on spam. Unfortunately, there simply doesn’t appear to be a single plugin or script that can filter the bad traffic, block bad bots and automated comment post scripts and provide a more traditional comment-based spam blocker.
I know Olaf has been working on my blog security for several years. He has tried a number of plugins and combinations of things. His efforts did include utilizing Akismet. However, since installing the configuration suggested in this post, my comment spam has virtually disappeared. YAY!
It’s funny sometimes how things on the web work. Around the time I handed over this article to Olaf, that old and low-traffic blog started getting hit. When I logged in to see what was going on, I found that somehow this blog missed getting Olaf’s security treatment and only had Akismet running. All of the spam comments, that were getting through, were obvious attempts at garnering backlinks to a number of different Facebook profiles. Granted, it’s running version 3.1.1 from back in March. However, your reply said the major changes were made a year ago.
About a screen’s full worth of letters and number with strings like “d0bed0b” repeated over and over again.
A shorter one with a different string of letters and numbers ending with a three word keyword phrase.
Another with some text and then this: “Posted on May 11, 2012 by” followed by a bunch of code that looks like it was trying to pull data from somewhere on Twitter.
What really has me confused is that my Akismet Stats for August are 167 spam, 51 ham, 0 missed spam and 0 false positives.
I have no idea of the true number of spam comments from August. Am I right in guessing that it would require me to flag “Pending” posts as spam to get them counted as “missed”? And, “false positives” would be things in my Spam folder that I marked as not being spam?
3 obvious misses out of 218 is obviously a great result – 98%. 21 missed still offers an 90% catch rate. Unfortunately, I suspect those numbers would have gotten worse, since someone has obviously found a hole to exploit.
What seems more worrisome is that there are only 20 comments sitting in pending and 1 in spam from this month – most of which came in yesterday and the day before. If Akismet is right and there were 51 “ham” comments, it would seem there are 30 ham comments missing.
I left the install of Akismet as it was in case you would like more info on the stuff that was getting through. Perhaps updating to the latest version would have flagged the spam that I received. Based on the changes identified in the Changelog on the WP Repository, I’m not sure it would have changed things though. I did, however, install AVH and AntiSpam Bee and they stopped the attack completely.
It’s possible/probably that the other 166 spam were auto-deleted due to being super-obvious.
Can you send me the key and blog that these stats are from (either at finke@automattic.com or support@akismet.com)? The ham stat being off by that much is strange, and the spam that got through sounds like stuff that is being caught on other sites.
Thank you for the information about how Akismet was actually storing too much on your site and affecting its usability. I am just starting a blog and I’m trying to choose an anti-spam product. While many articles complain about the cost of Aksimet, your article is giving me another more serious issue to consider: am I capable of debugging problems created by Akismet.
I actually have the same issues with Akismet. I just think it has been letting way to much obvious spam through over the last 6 months or so. I didn’t use to need to go through approved comments and spam-mark anything (or very few) before but these days I know that of the approved comments 90% will be obvious spam-comments.
I also do not think the ham-number is correct. It says that in July 2016 so far I’ve gotten 52 ham-comments … but I only have 5 approved comments. Unless it counts all it incorrectly marked as “approved” and ignores that I’ve spam marked basically every one of them?
thanks for sharing your experience with Akismet.
Interesting post in regards to stopping spam. I honestly have never needed anything better than akismet but its nice to know that there’s a lot of alternatives out there just in case if I ever get to the point where askimet is no longer doing what I need it to do.
I have an issue related to Akismet. Hope you guys could help me. I am using GoDaddy WordPress hosting. I have never installed Akismet. But recently it appears (by itself) on my WordPress Website. I am not able to remove it neither from WordPress nor from the ftp. Why did it appear by itself when I dont even need it? I dont let ppl cooment nor register to my website. I dont need it. Do you guys have any idea?