Anti-spam
In short: Champ blocks a lot of spam for you, automatically. Most stores only need to change two or three settings. See settings we recommend. If spam is flooding your forum right now, go to stop a spam flood.
Your forum is a public page on your store, and Google can find it. That makes it a target for spammers. So Champ uses several checks, not one. No single check stops every spammer.
Two kinds of spam attack#
Spammers attack in two main ways. A check that stops one often misses the other.
| Older attacks | Newer attacks | |
|---|---|---|
| What the posts look like | Obvious junk, stuffed with keywords and a short link | Normal-looking text, written by AI |
| Where they come from | A few IP addresses, thousands of posts each | Over a thousand IP addresses, a few posts each |
| Accounts | Mostly no account (anonymous) | Mostly signed-up accounts |
| Caught by reading the text | Nearly all | Almost none |
An IP address is the internet address a post is sent from.
Reading the text works less well as AI writing gets better, and AI writing is now free. Counting posts per IP address misses an attack spread thinly over a thousand addresses. Each check covers what the other misses. That is why Champ uses both.
How Champ checks each post#
First, a post must pass these basic checks:
- It must come from a real web browser.
- A hidden form field must be empty. People cannot see it, so only spam robots fill it in.
- One IP address cannot post too many times in a minute, or in an hour.
- Anonymous posts on your store are capped per hour.
Then Champ checks the post itself, cheapest check first. The first check that flags the post decides, and Champ takes the post down automatically.
- Champ's blocklist — IP addresses and networks we know send spam.
- Champ's own spam record — IP addresses that spammed other Champ forums. When one store is attacked, every other store is protected.
- Reading the text — Champ scores the words for signs of spam. Still useful, but not enough on its own.
- Outside spam lists — StopForumSpam and Project Honey Pot, two free services that track spam IP addresses.
- Akismet, only if you add your own Akismet key.
Note We test the outside spam lists against the real attackers we see. They often catch none of them. We keep them because they are free and sometimes catch something. Do not rely on them.
Settings we recommend#
Most stores need very little. From most useful to least:
- A wait between posts. In Settings, in the Anti spam section, set Minimum seconds between posts by the same user to 30 to 60. Real members will not notice. Spam robots are badly slowed down.
- Require sign-in to post. Do not allow anonymous posting unless you have a strong reason. This one change removes most spam. See letting people post without signing in.
- Approval on public forums. New posts wait for a moderator. Slower, but spam is never visible. See the moderation guide.
- Akismet, if you have a key and want a second opinion on the text.
Akismet#
Akismet is a spam-checking service used by many websites. Champ uses it only if you add your own Akismet key.
- Get an API key (a password-like code) from akismet.com.
- In the Champ dashboard, open Settings.
- In the Anti spam section, paste the key into Akismet API key.
- Click Save.
Champ now sends every new post to Akismet, as well as running its own checks. Posts that Akismet flags as spam are deleted. To turn Akismet off, clear the field and click Save.
Careful Akismet receives the post text, the poster's IP address and their browser details. That is your customers' content going to another company. If that matters for your store's privacy, leave Akismet off.
Stop a spam flood#
If spam is pouring in right now, do these in order:
- Turn on approval for the forums being hit. Nothing new becomes visible while you work. See the moderation guide.
- Turn off anonymous posting, if it is on.
- Set a wait between posts, if you have not already.
- Email us at support@getchamp.net. We can see the attack across every Champ forum. Blocking it on our side is faster and lasts longer than anything in your dashboard.
Do not start by deleting posts one at a time. Stop new spam first. Cleaning up is easy afterwards, and impossible while spam keeps coming.
Cleaning up after a spam attack#
- A few spam posts: delete them yourself.
- Thousands of spam posts: email us with your store's address. We have a tool that removes spam in bulk. It shows you exactly what it would delete before it deletes anything.