Anti-spam
Forums on a Shopify store are public, crawlable pages on a real domain, which makes them a standing target. Champ's defences are layered on purpose: no single check survives contact with a determined spammer, and the two common attack shapes need completely different answers.
What you are actually defending against#
There are two kinds of flood, and a defence tuned for one misses the other entirely.
| The old shape | The current shape | |
|---|---|---|
| Content | Keyword-stuffed, obvious, a shortened link | Plausible prose, written by a language model |
| Source | A handful of addresses, thousands of posts each | Over a thousand addresses, a handful of posts each |
| Accounts | Mostly anonymous | Mostly registered |
| Caught by content scoring | Nearly all of it | Almost none of it |
Content scoring reads the text, so it decays as the writing gets better — and plausible writing is now free. Rate limits count posts per address, so they miss a flood spread thinly across a thousand of them. Each covers what the other cannot. That is why the stack is layered rather than a single switch.
The layers#
Every post is checked before it is saved, cheapest check first, and the first layer to object stops it:
- A blocklist of known-bad networks, applied before anything is written.
- Cross-store reputation — Champ's own record of addresses that have spammed other Champ forums. A merchant being attacked today protects everyone attacked tomorrow.
- Content heuristics — scoring the text itself. Still worth having; no longer sufficient alone.
- External reputation services — StopForumSpam and Project Honey Pot.
- Akismet, if you supply a key.
Before any of that, a post has to clear: a required browser user agent, a hidden honeypot field that only automated clients fill in, a burst limit per address, a sustained limit per address, and a cap on anonymous posting.
Note We test the external reputation services against the attackers we actually see, and they frequently score zero of them. They are kept because they cost nothing and occasionally catch something, not because they can be relied on. Do not treat them as your defence.
What you should turn on#
Most stores need very little. In rough order of value for effort:
- A minimum interval between posts (Settings → 30 to 60 seconds). Free, invisible to real members, brutal to scripts.
- Require sign-in to post. If you do not have a strong reason to allow anonymous posting, do not allow it. This single setting removes most of the problem.
- Approval on public forums (moderation guide). Slower, but nothing bad is ever visible.
- reCAPTCHA, if you allow anonymous posting or registration is being abused.
- Akismet, if you have a key and want a second content opinion.
reCAPTCHA#
You bring your own keys, so the challenge is issued under your own Google account and quota.
- Register your site at Google reCAPTCHA and get a site key and a secret key.
- In the Champ dashboard, go to Settings → Anti-spam and paste both in.
- Save. Both keys are stored encrypted.
Your customers now see a challenge on the forms you have protected.
Akismet#
Akismet is the spam service behind a large share of the web's comment forms. Champ will use it if you provide a key.
- Get an API key from akismet.com.
- Paste it into Settings → Anti-spam and save.
Champ then submits post text and the poster's address to Akismet for a verdict, in addition to its own checks. Note that this sends post content to a third party — if that matters for your store's privacy posture, leave it off.
You are being flooded right now#
In order:
- Turn on approval for the affected forums. Nothing new becomes visible while you work.
- Turn off anonymous posting if it is on.
- Set a minimum interval between posts if you have not.
- Email us. If the flood is spread across many addresses, we can see the shape of it across every Champ forum, and blocklisting at our end is faster and more durable than anything available in your dashboard.
Do not start by deleting posts one at a time. Stop the inflow first; cleanup is easy afterwards and impossible during.
Cleaning up afterwards#
For a handful of posts, delete them from the dashboard. For a flood measured in thousands, email us with your store domain — we have tooling for bulk removal that runs as a dry run first, so you see exactly what would be deleted before anything is.