Sometimes simple is better.
Since 2011, I have painstakingly identified, compiled, and optimized over 57,000 phrases, patterns, and keywords commonly used by spammers and comment bots in usernames, email addresses, link text, and URIs. As with all compilations, this blocklist is a work in progress and there will always be room for improvement and optimization.
Suggestions and bug reports are certainly appreciated. Please use the issue tracker to let me know.
Manual Installation
Copy the list of keywords found in the blacklist.txt file, paste it into the Disallowed Comment Keys field of your WordPress Discussion Settings panel, and click the “Save Changes” button.
Note that the Disallowed Comment Keys field was previously named Comment Blocklist in WordPress 5.4 and Comment Blacklist in WordPress 5.3 and earlier.
Repeat this procedure each time you want to install an updated version of the blocklist.
Automatic Updates Via Plugin
If you prefer a more hands-off approach, there are several plugins that will check whether the master blocklist has changed and then automatically install the most recent version. How handy is that?
- Block List Updater by Pluginkollektiv
- Comment Blacklist Manager by Andrew Norcross
- Comment Blacklist Updater by Apasionados
- Shield Security by Shield Security
- WP Toolbelt by Ben Gillbanks
- Zero Spam for WordPress by Highfivery
For users of the Gravity Forms custom form builder, Gravity Forms Blocklist is an add-on that takes advantage of the automatic blocklist updates provided by one of the aforementioned plugins.
I don’t blame you if you’re skeptical about how well this blocklist works compared to a commercial solution like Akismet. Because I am subjectively including keywords based on comment spam submitted to my own sites, there is a chance that the blocklist will “overclean” your comment queue.
Consider that fair warning.
However, Jason Cosper reports that he used an earlier version of the blocklist on a client’s WordPress installation containing 800,000 or so comments. The blocklist flagged 40% of those comments as “spammy”. As a sanity check, he then exported those flagged comments to a local WordPress install and subsequently had Akismet do its thing. According to Jason, there were “zero false positives.”
Still need convincing? The blocklist was featured over at WP Daily (now Torque) in John Saddington’s enticingly titled post, Die Spam! Blacklist That Shiz with This Gist!
WordPress stores the contents of the Disallowed Comment Keys setting in the options table as disallowed_keys. Defined as a longtext data type, this MySQL column can contain up to 4,294,967,295 bytes (approximately 4GB) of text. There is no chance of us running out of room to expand the blocklist any time soon.
Note that the disallowed_keys option was previous named blacklist_keys in WordPress 5.4 and earlier.
URL Shorteners
As mentioned above, the keywords in the blocklist are based on spam submitted to my own sites. Spammers often utilize the obscuring capabilities of URL shorteners to hide their nefarious links. Therefore, I have included a handful of URL shortener domains in the blocklist. For all practical purposes, there’s no need for a comment to include a shortened URL, as unmodified links can be easily formatted using HTML. If you find that your visitors are using shortened URLs on a regular basis, you may wish to remove some or all of these domains from the blocklist.
WordPress Links
Spammers will also utilize links that include URLs that are specific to WordPress installations. These links often point at compromised admin files, themes, or plugins. In most cases, there’s no need to include a URL that deep-links into the bowels of a WordPress site. However, you may want to remove the following keywords from the blocklist if your visitors are commenting on topics related to WordPress site, plugin, or theme development.
- /wp-admin
- /wp-content
- /wp-image
- /wp-include
- /wp-json
- /wp-list
- /wp-plugin
- /wp-site
Non-English Comments
This blocklist has been created for use on English language sites. There are several dozen terms and phrases included in the blocklist that may flag legitimate comments posted in other languages. If you commonly receive comments in other languages (specifically those containing Chinese, Japanese Hiragana and Katakana, Korean, Thai, or Cyrillic characters), you may want to remove or modify those sections of the blocklist.
HTML Tag Attributes
The blocklist is not applied against HTML tag attributes found in comments, only the values assigned to those attributes. This means that you cannot include the attribute name, equal sign, or the quote marks as part a keyword. For example, the keyword phrase title="Discount will not match anything, even if that exact bit of text exists within the content of an HTML formatted comment. A keyword consisting of Discount should be used instead. Other HTML attributes commonly allowed in WordPress comments such as href, cite, rel, and datetime are also ignored.
User Agent Strings
According to the WordPress Discussion Settings Screen documentation, a comment will be marked spam if any of the Disallowed Comment Keys terms are found in the comment content, name, URL, email, or IP address fields. Surprisingly, WordPress also applies the blocklist against the user agent string.
For example, an earlier version of the blocklist contained the keywords /4. and /5. to flag URLs with sequentially numbered pages with various file extensions. Unfortunately, these two benign-looking keywords also flagged comments containing common user agent strings, such as Mozilla/4.0 and Chrome/5.0. In other words, nearly every single comment was flagged as spam, regardless of its content or whether the commenter had been previously approved.
IPv6 Localhost
Since the blocklist is applied to commenter’s IP address, we need to be aware of strings that might match seemingly generic, but valid addresses.
For example, in an earlier version of the blocklist the keyword :: had been included, as it appeared occasionally in mangled comment text and URLs. However, double colons are also part of the IPv6 localhost IP address ::1. If you happened to be testing a WordPress installation on a system using IPv6 addresses, every single comment would have been flagged as spam.
“So much for using Akismet.”
Thanks to Mika Epstein, Ben Gillbanks, Paul Goodchild, Sergej Müller, Andrew Norcross, Clifford Paulick, Fabrizio Salmi, Volker Schmidt, and Claudio Schwarz for their various contributions, suggestions, and reports from the field.
Likewise, Chris Burton deserves a virtual fist bump for the above quote.
I’d also like to acknowledge John Hughes, Paul Taubman, Christina Robinson, My Brain Lounge, Roger Williams Media, eComStyle.de, FliegenToeter, WPCoder, Nguyễn Đình Quân, and Torque for mentioning and linking to this project.
See the history for a chronological list of changes, bug fixes, and other milestones.
Copyright © 2011–2024 Grant Hutchinson
This project is licensed under the short and sweet MIT License. This license allows you to do anything pretty much anything you want with the contents of the repository, as long as you provide proper attribution and don’t hold anyone liable.
Please refer to the license included with the source for more information.