8 ways to protect your forum or community from spam

1. Email Verification

Email verification at the main gate ensures that only those with legitimate credentials (valid email addresses) are allowed to enter. It requires users to verify their email addresses before they can participate. Right after registration, the user gets a confirmation email to his inbox with a confirmation link. If he clicks on the link, it is verified.

This step helps filter out spammers using fake emails. If they never confirm their email address, they will not be able to participate.

This approach should be used in every community. Even if you additionally require a manual verification by admin, you can save time omitting reviews of accounts with unconfirmed mails.

However, this is only half the truth. There are plenty of services that offer so-called disposable email addresses. 

2. No disposable emails

A disposable email address (DEA) is a temporary email address that users can create and use for a short period or a specific purpose.

Spammers typically generate a new disposable address, use it to sign up for your community, confirm the registration, and then discard the email. Many services offer instant generation of these addresses.

Examples of disposable email services

• Mailinator: Provides public, disposable email inboxes.
• 10 Minute Mail: Offers email addresses that expire after 10 minutes.
• Temp Mail: Generates anonymous, temporary email addresses for short-term use.

How to check if email is disposable?

I use some free tools like ZeroBounce to check and ban questionable emails:

I prefer the best (primary) email address of the user. On my part, I do everything to protect my users from spam, ensuring my outgoing emails cannot be spoofed in any way.

Some community engines like Invision Community already have a built-in checker for disposable emails. However, their database is not perfect. It does not recognize all disposable emails and lets some through as valid addresses.

That's why I still use the tool above if in doubt.

3. Review and approve new members manually

The safest way to manage new members is to manually review and approve each application. It’s like closing your castle gate, letting people wait outside until everyone’s identity is checked. This approach can effectively control spam, but it also has several disadvantages:

• Time-Consuming: Reviewing each application individually takes significant time. You have to do it regularly, regardless of the time of day or vacations.
• Scalability Issues: As the community grows, the volume of applications can become overwhelming. Reviewing five applications is feasible, but what about 50 or 100? Do you have enough time to manage this alongside community growth?
• Delayed Engagement: New users cannot engage with the community immediately. This can reduce their initial enthusiasm and overall engagement. If I join a community, I am ready to participate, for example, by asking questions now. If I am not able to, I will probably find another way to solve my problem. A delayed approval might make me lose interest.

Certainly, there are some community models where this approach makes sense. For me, delayed engagement and user frustration are the biggest pain points with this approach.

4. The most spammers are not human: CAPTCHA?

Nowadays, the most spammers are not human. They are bots, programs that scan the internet for opportunities to add user-generated content with their spam.

They do not aim at you personally or target your community specifically. They do it fully automatically. To prevent bots from registering in your community, you can use CAPTCHA. CAPTCHA is an acronym for “Completely Automated Public Turing Test to Tell Computers and Humans Apart”. This security measure differentiates bots from humans, typically with an image or audio challenge. 

This technique has been developed 25 years ago and consistently improved.

In my opinion, while it is getting more complicated for the humans to get through the challenges, bots learn to break them faster. I do not use it. As an administrator and community manager, I have no control, who has been blocked. The more inexperienced the users, the higher the chance they will not bypass the challenge, but well-developed spambots will.

While CAPTCHA offers a rudimentary protection from spam registration, you cannot rely on it entirely. It also will not stop manual spam or spam coming from CAPTCHA farms.

5. Spammer database and anti-spam services

There are anti-spam service that provide protection for forums and online communities by using history of spam activity. When a user interacts with a website protected by such a service (e.g., submits a registration form or posts a comment), the data is sent to their servers for analysis.

• IP Address: Checks if the IP address is blacklisted or has a history of spam activity.
• Email Address: Verifies the email address against a database of known spammers.

They also learn from the decisions by analyzing feedback from site administrators. If you mark a user as a spammer, the feedback goes back to the service. The next registration will be blocked due to the history of spam activity.

Especially for communities, there is a service called CleanTalk. CleanTalk starts at $8.00 per website per year and offers a free 7-days trial with no obligation. This is a powerful solution as it combines the efforts of all CleanTalk users.

The best part is, the logs show you exactly who, why and with what content has been blocked. No black box like CAPTCHA. You get weekly stats via email if you like. 

To integrate CleanTalk in your forum or community, you can use ready-made plugins.

It is worth testing it for 7 days for free to decide whether it is helpful or not. 

This is how the configuration area for CleanTalk looks like in Invision Community.

6. Blacklists and Whitelists

Some community engines allow you to set blacklists for IPs, email domains, and even geographical regions. If you encounter a lot of spam from certain countries and do not target users from those areas, you can try to exclude registrations from these countries.

However, blocking by IP can be very problematic for several reasons:

• Dynamic IP Addresses: Many internet service providers (ISPs) assign dynamic IP addresses to their users. This means that a legitimate user might be assigned an IP address previously used by a spammer, leading to false positives and blocking innocent users.
• Shared IP Addresses: In many cases, multiple users share a single IP address, especially in corporate environments, universities, or public Wi-Fi networks. Blocking an IP address could inadvertently block a large group of legitimate users.
• Temporary Effectiveness: Blocking an IP address only temporarily stops spammers. They can easily switch to new IP addresses, making this approach a cat-and-mouse game with limited long-term effectiveness.
• Limited Scalability: Managing and maintaining an IP blacklist can become a cumbersome task, especially as the community grows.
• Collateral Damage: There is a high risk of collateral damage when blocking IP addresses. Legitimate users can be unfairly punished, leading to frustration and loss of trust in your community.

I never rely on IP only and use a combination of several methods.

7. Filters, restrictions, and reports

There is no way to protect your community 100% from spam registration. Therefore, you have to set up another level (the inner wall) for those who are already in.

There are some automatic measures, such as:

• Content Filters. These filters automatically block content containing specific spam-related words, phrases, or links.
• New Member Restrictions: Newcomers can be given limited access until they prove their good intentions. For example, you can moderate the first post of every newly registered user. Personally, I do not like the idea, as this decreases the engagement. If I post now, I would like to have an answer or reaction now. There are plenty of other places for user to get instant feedback. This is how the world works nowadays.
• Flood control. By limiting how often a person can post or send messages, you can at least prevent spammers from overwhelming the community with a flood of content. This makes it easier to prune the spam if they manage to post it.
• Feedback loops. Some community engines allow community members to report inappropriate content. For example, Invision Community has an automatic moderation feature. If a certain number of community members report the same content, it will be automatically hidden.

8. Advanced methods

Two-Factor Authentication (2FA) enhances spam protection by adding an extra layer. It mandates users to provide two types of credentials to sign in: typically a password and a one-time code sent to their mobile device for registration.

However, it has its drawbacks: it can prolong the registration process and may compromise users' privacy if they prefer to keep their mobile numbers confidential.

Do you experience spam issues in your community? How time-consuming is spam handling for you? What tools do you use? Share your experiences and ideas in the discussion.