HACKER Q&A
📣 busymom0

What's you strategy to prevent spam in the comment section of a website?


Those who have run websites wit comment sections, or posts, what's the best way to prevent spam - particularly commercial spam?

I see spam even in YouTube and Twitter comments now a days so I am wondering if it's too hard to handle?

My backend will be either NodeJS or Rust and Postgres database and Redis if needed.


  👤 akg_67 Accepted Answer ✓
1. Manual Moderation. All comments manually approved before publishing.

2. Identify TLDs and keywords in spam comments and automatically delete those comments to reduce workload for step 1.

3. If it is an English site, delete all comments not in English alphabet or language of site.

I was able to delete ~98% of comment spam through these three steps. I had a custom page that showed all comments that passed through filters. I could bulk delete spam comments from this page and bulk approve real comments. If I notice spam comments getting through, I will add keywords and domains from those comments to my filter subroutine.

It was a cat and mouse game, but worked reasonably well. I made few good connections and friends through comments so I will not suggest to disable commenting unless there is no reason for someone to comment or can make contact through other means.


👤 cpach
Simple “captchas” can help.

Like “what is the answer to 3 + 2?” or “Name one ingredient in a PBJ sandwich” or something like that.

For small sites, that can be enough to weed out spam but enable the “ham” to make it through.


👤 marto1
If you have accounts one thing to do is to set a (unknown to users) daily comment quota. Set it to like 20 or something you consider very high and make an alert fire if someone reaches the quota. At this point the user shouldn't be able to comment and you should review manually case by case.

👤 DamonHD
I have basically avoided the issue in my own sites by not having UGC / comment sections since the '90s.

On other sites that I am or have moderating/ed, very tight filtering on who gets in as a user in the first place, with final manual approval, seems to work.