Tricks to Fix and STOP Website Spam

Monica 0:00 Monica, Well, hello again, and welcome back to marketing with purpose. I'm Monica Pitts, your host, and today we're talking about something that makes us question why you even have a contact form? Yeah, website, spam. You know the drill. You wake up to 47 emails about cryptocurrency. Someone wants to sell you SEO services. They always want to sell me SEO Services, which is very ironic to me. And three bots are very concerned about my website's performance. Cool, cool, cool, right? Like, super awesome. And here's the deal, you don't have to live like that. And today's episode is all about tricks to fix and stop your website spam. And I brought in our resident security expert, Rebecca Thomas, to share the actual solutions that work. Say Hi, Rebecca, new friends. So we lovingly call Rebecca mayecreates Security rain cloud. She manages our safe site program, which means that Rebecca is the primary human keeping over 300 websites safe from the digital Riff Raff every single week. She's basically a professional bot bouncer. Yeah, that's you. Rebecca. I like that. You can flex your digital muscles. Get it So fair warning. We are covering everything today, from the basics like turning off comments all the way to advanced tactics like IP blocking and Rebecca might even go on a tiny tangent about poisoning bots, because, apparently, it's a fad, and it's one we're like, super excited about. It's a real thing. Okay, Rebecca, are you ready to unveil how you bounce bots? Oh, heck, yeah. All right, cool. Let's get to business. You're on a mission, and you just need more people to know about it. And whether you're brand new to marketing or a seasoned pro, we are all looking for answers to make marketing decisions with purpose. I'm Monica Pitts, a techie, crafty business owner, mom and aerial dancer who solves communication challenges through technology. This podcast is all about digging in and going digital. I'll share my marketing know how and business experience from almost 20 years of misadventures. I'll be your backup dancer so you can stop doubting and get moving towards marketing with purpose. You okay, so. Rebecca, how you bounce bots form spam? That's what we're talking about today. How to get rid of it. You don't have to wait until you have spam to do these things, right? Rebecca, I think that's the first lesson I want everyone to take away, even if you listen to nothing else, you can fight spam before it hits right, so you will get it eventually. That's what Rebecca says. It's not if, it's when, Yep, yeah. So you can start preemptively. You can start dealing with it from the very beginning. All right, so Rebecca, we do get emails occasionally from clients. Even though we start fighting it at the beginning, we start fighting it as soon as we launch a website. We do sometimes get emails from clients, especially those that we inherit, like we didn't build their websites. And so you have some tasks that you do as your first line of defense. Walk me through the things that you do. All right? So like we said, it's not uncommon for sites that we've inherited to come and be like, hey, my form is getting really bogged down with like these Russian comments of like, Hey, you want to meet a pretty lady. And if it's a church website, that's a really concerning content. So the first thing you want to do is, if you don't need comments on your website, turn them off, or at least have them audited if you do allow comments. Basically what that means is, if you want comments on the post of your website, say you're a blogger, make sure that you have to review and moderate the comment before it is pushed to the general public. You can also make sure that if they are trying to post a comment, you want to have them put in their email and username, so you have an ability to track who's coming in what things you can block if they are offending in certain ways, for spam content. You could also make it that any post that you create after a certain number of days or weeks, it'll close the comments so you're not getting spammed on say something that you posted last year. You can also do things like making sure that those comments if. Comment comes in with specific words. We see a lot of ones, like we said, with marketing, with SEO, with less than savory content. If you know the words that you see repeatedly, you can add them to plugins such as a Kismet or other ones that I can't think about the top of my head, and they will automatically block those posts from reaching anybody. So a kismet, you would put words that you are seeing repeatedly in the spam. You could put it into the Akismet settings, and then it would it would call those comments, is what you're saying. That is how it should work. Yes, okay. And a Kismet is, I can't remember. I look it up as you're talking. I can't remember if it's free or not. It does come like there's a pre installed in almost any wordpress install that and Hello, Dolly, yes, and I do believe that might be specifically with our personal hosting. I don't think every hosting company has that option, so you might be able to find it in the WordPress plugin search, if you would like to add plugins. There are also a couple of other options, but this is the one we see the most often Akismet for personal use is free and then Pro. So that single site use for professional or commercial sites and blogs is 995 a month. Yes, which I mean, like, if you equate it out to your hourly rate, and think about the number of hours you might be spending sorting through and deleting spam, it could actually be worth that $120 a year. Yeah, in the long scheme of things, even just making sure that you don't get bogged down and don't have code injected, which we have seen once every now and again, because they find a back door through comments, we see that less common now, I do believe that's the patch. You save yourself some heartbreak, honestly, yeah. But so go ahead, moving on to form. What's the next thing? So with forms, like we said, forms are a heavily spammed piece of content on your website, it's actually, besides the comments, the second most place that you'll find spam, at least in my experience. So what you need to do is, of course, every form needs reCAPTCHA, whether you use google recaptcha or H capture, or if you have been super smart and coded your own so you don't include cookies in a way that you know breaks GDPR and other cookie mandated rules that we all have to live by. It's important friends have that there. We personally use invisible though the checkbox is still pretty much viable. We also have the ones we have the Test your level secure. Your level of security is really up to you on that one. So tell us what reCAPTCHA is. So that way people who aren't maybe quite as tech savvy as you can see it in their heads. Okay, so reCAPTCHA, I do believe everyone has seen it at some point, whether or not you have purchased something, or if you've had to go through some kind of service inquiry or any kind of question, there's a form, and at the bottom right before the submit button, you might see a little checkbox that says, I am not a robot. Or you might see it in the bottom, like right hand corner, Google has a little tag that said, power by reCAPTCHA or something, what it does. And I'm going to speak in very general terms, because I'm not sure how to get quite into the science of it. ReCAPTCHA tracks how you interact with the page, and it uses a learning model to sort of compare that to human interaction versus known bot interaction. So when you move your mouse, you have a tendency as a human to meander your mouse. You don't go straight for the check box. You don't go straight for the fields a bot will it's a straight line most of the time, or when you type something out, your human patterns aren't quite able to be replicated by a bot at this point, whether or not that will change, and whether or not we have to update how reCAPTCHA works will remain to be seen in the future, but then that's where we also have the you got to recognize the images, or you have to type in the little wordy word. AI is very good at learning those patterns. I'm not going to call it smart, because that's not what it is. It is learning. Patterns, but your human self will always be able to generally sort of parse through that in a way that says, I am not a robot. So it's not so much the checking of the box. It's your behavior when you're getting to the box. Oh, I didn't get that well, but then the invisible is recaptchas probably doing something similar, right? Is it watching your behavior? Yes, it's watching your behavior. And there are some hidden things behind that. Will also say, like, some recaptchas have, like, a specific field hidden that you as a person can't see, but a bot would be able to see in the code, and if they click it, then, you know, oh, that's a bot. Get it out of here. Wow. Okay, so they're very sophisticated, and that's fun. I am not a fan of those type what you see or picture recaptures are there? Like, when do those pop up that we don't have them on any of our websites? Do you have to select that? Do you choose those as your reCAPTCHA? Yes, so you can choose it when you first set up your reCAPTCHA, you do choose, at least with Google, the one I'm most familiar with, you will choose what kind of reCAPTCHA you have set up. You can have the test in there. Sometimes the test is automatically implemented. Very, very rarely have I seen that happen, but we have had for check boxes the test come up just because maybe that site is seeing a little more than usual. I'm not totally sure if it automatically happened or if a check box was checked without my knowledge, but it is generally a choice of yours. Gotcha? Yeah, my dyslexia does not enjoy the letters, no numbers. I'm like, What is that thing? I don't know. Could be a six. Could be a nine. We'll take our best guess. Think hard. Monica, thank God, yes. And then, like, we use a specific form plugin, and it's called formidable. Not all form plugins are created equally, right? So not all form plugins are going to let you implement a reCAPTCHA easily. What else can you do in your form plugin that's usually simple, that would allow you to check for spam submissions? So I won't name drop anyone who's failed my list, but I will say specifically, we should, you should name drop them that way. They don't use them. We have issues with Gravity Forms and Ninja forms. I'm so sorry. I'm not I'm not editing anything we think, I mean formidable forms is not perfect by any means. We just found like an ADA color contrast glitch in it just last week, and my heart was a little broken, and now we're gonna have to go back and update a bunch of sites. The error messages are not ADA compliant color wise contrast. They do just see sad. Yeah, we're gonna submit a message to them, though, so that way they are clear on it. But it also does some things really well. So if you're using formidable, what, what else can you do to make it so you don't have spam? So the cool thing about formidable is that you can do conditional logic. First and foremost, whenever I get a comment from a client, the first thing I do is I go in and I make sure that there are the appropriate fields are required. So say you need to have your email address in there. You need to be able to click certain things. So making things required so they can't just skip them. Super, super great. You can also turn on things like honeypot or a JavaScript sort of review, what honeypot does, similar to how the reCAPTCHA I said some of them have that sort of invisible field where if a bot interacts, it gets kicked. Honey Pot is the same thing. Think what's the best way to put that? Like World War, something spies, you've got something very enticing, and you get the information you need because you are very enticing. Enticing, enticing. That's the best way. That's the word I'm going to use to be safe for work. Fine. It's fine. A scantily glad madam gets all the information. So your honey pot is essentially glad madam attracting them when they interact. Yeah, it's great make sure they're turned on, because it really does help sort of mitigate the amount of spam that you'll see come in and then back on a. Other conditional logic. Things that you could do, last ditch resort, which I do keep in my back pocket, for formidable, specifically, I don't know if other plugins have this. Formidable allows you to add conditional logic to the submit button. And so what you can do is you can create a field that is mandatory, as we said, you can make required fields that required fields can be something like, please pick the identity that best represents you, and then you'll have questions like, I are responses? I am a robot. I am a AI. I am a real person. I think ours says I am a penguin, yeah? Ours does which I absolutely adore. You can be fun with your security. Yeah, whimsical, yeah. But when that required field is incorrectly checked, because a bot might pick the first one or the last one instead of being able to read the thing, you'll have a real person click, I'm a real person, and then the submit button will either show up or reactivate. Now that so that, I think it's really fun, by the way, and we've done it on a number of client sites, and I keep finding it now that we actually planned out this episode, and I go out and I check websites regularly, every single week, I'll find them, and it's like, I'm a pony, I know, oh, I'm a scarecrow. That was such a good one, but that's kind of nice, because you wouldn't get nearly as many false positives for that some of the more automatic settings. Rebecca, you said that you can get false positives as SPAM for them. So tell us about that. So and I haven't found a clear reason why it always happens, but we saw this specifically on our website occasionally, either the way that someone's browser is set up, or maybe just the way that they act or how they have interacted with other sites or the site that they're currently on, for some reason, they automatically get flagged. I don't have a clear reason behind this. There are ways to get around with it, keep your recapture. Obviously, it's super, super helpful. But you can turn off the honey pot. You can turn off the JavaScript for this plugin, if that's happening. But if you are a real person and you are seeing yourself constantly getting flagged as spam, do go ahead and maybe reach out. Someone will probably be able to help you with your question, whatever that is. It's not on purpose. It's just something about the settings is saying there's something wrong, and maybe you should run some malware scan on your site, not your site, your your computer, on your computer. You should when? So if something is flagged as a bot, would it be recorded in the database as a submission or No? No? No, no, okay. Unfortunately, at least with the way that formidable works, if you are unable to push submit, you will not have an entry created, which is the reason why it's there, so that bots can't flood your website with submissions with less than desired content that you have to dig through to find your real clients. It's a catch 22 it happens very rarely. We have only seen it happen twice out of the 300 sites that I house. And to be fair to the two sites that it happened with, they had over 20 forms each. Okay, so you might, they might have been blocking for a lot of stuff. Yeah, yeah, yeah. Okay, so it sounds like our first line of defense, to recap, is just make sure that your comments are off or audited. So if you don't need comments on your posts, just turn them off. People don't use them all that often anyway, unless you're a very specific type of site. So I don't feel like they need to be on in general to start. And if you do have them on, make sure that you are auditing them. You also should always implement reCAPTCHA on every form. And if you have the ability, you can turn on that honeypot security, it's just checking a box, and then you would have all those additional things. And these, those, those three things that I just listed, I feel like those are things that should happen before any website goes live. Make sure your comments are off or audited info. ReCAPTCHA on every form, make sure that the honey pop box is checked. I think that should be anytime before your site goes live. Just do it. And then I then you could use a plug in, like a Kismet that monitors spam comments if you are having comments in on on your website. So that would be the fourth thing, if you are allowing comments, you can use a Kismet or another plugin like it, and it would help you manage that stuff. Now let's say that that stuff is not enough. Our first line of defense not enough. Okay, so then we have the manual test, right that's adding the additional form that or field that Rebecca was talking about, and making sure that your submit button is made conditional, so that they have to pass the logic tests in order to do that. What else can they do? Rebecca? So honestly, you should be having this from the very beginning. If you have a site, always have a security program of some sort, whether that is word fence, whether that is defender, whether that is solid security, all three that we are very familiar with, personally have something that's got a bit of a firewall. Your data is really important, and I'm sure your website is important to you, both as a monetary asset and as a business asset. You've spent time and love and care into setting this up, and you really should be protecting it just the same way you would protect your home or your car, your security program. Lock the doors, lock the doors, lock the doors. Friends, exactly. You can also use a CDN. We specifically, actually have worked previously with Cloudflare. And okay, can I go on my little tangent? Yeah, for sure. Do it? CDN go. So Cloudflare specifically is super, super cool. We've mentioned it before, I think in a couple of other podcasts, they keep your website safe using lava lamps. So there is basically no possibility in them getting into your website, because what they're being served is a static sort of copy of your website. They can't get to your real one, and that copy is locked down with a code created by an ever changing video of like, 100 lava lamps on a wall. I feel very safe with a lava lamp. Who knew lava lamp security? Nice, actually kind of fun. So right? What that protects against, like, specifically a lot of people, you'll see more and more websites as you interact with the internet lately that are using Cloud player specifically because we're having issues with DDoS attacks. So basically, what that means is that bots or just individuals are hammering your website with requests which overloads the system and either creates a backdoor for them, just by the virtue of, you know, being overwhelmed, or just shuts down the entire website totally, because the server just cannot handle that many requests. So you'll see it more. We see it every day when we log in to our hosting portal, because they do have a partnership with them. I see it on several of the websites that I frequent for my own personal content consumption, I see it too. I've been seeing it more and more. It'll be like, hold on a second. We need to make sure that you're a human and you have to go through a reCAPTCHA to even get to the CDN site. It'll be like, everything's white, and you, like, check a box, and then it lets you over there, and yeah, and a CDN is, like, positive in many ways. It it speeds up your load time. It re secures your site. Like, your site is Uber secure when you're using a CDN now, I mean, it does have a few drawbacks, because when you're going to make updates, things can be funky. It takes longer. But, I mean, we use it on our MayeCreate site, and we have for years and years, and there's actually a Cloud Flare package. It's free. When I found out about it, I was like, what? So you're telling me that I can do this and it doesn't even cost any money for people. This is incredible. So definitely check it out if you're having either load time issues or like getting attacked by bots, if you're if you have lots of spam, the CDN is a battle full thing. So if I use a security program, Okay, moving on from the CDN, because clearly we could have a CD and love fest, and we just did. So if you use a security program, then that allows you to do a couple more things, like manually right to keep things safe. Tell me about those. So specifically, I'm going to talk about defender Pro. We're not sponsored. Let's be very. Clear, but I we have no sponsors, not for anything, not for CloudFlare, not for we pay for these programs people, they don't pay us. I wish they. Should Know you think we can get a partnership. I just love them so hard, like they make our lives easier. Formidable. Nope, nobody pays me for that. Nope. I pay them for every site we put it on. Yep. He loves these All right, these things, but we use defender Pro, and I have fallen deeply in love with basically, it's out of the box, working this. And one thing that it does really, really well is one block bots. They have an automatic sort of bot blocking with the pro version as well as it enables audit logging. So audit logging, in this sense, is basically, if there is activity on the back end of a website, we do get a little notice of username updated page, or username logged in, or username failed to log in. And so what audit logging has done is let us know when there is sort of hinky actions happening on the website, and so you can actually automatically start taking action based on that list. So we saw on a couple of websites, hey, someone's trying to log in with admin one. Well, that's not a user on this website, so I can add it to a list of user names that automatically block if you try to log into it. Or I have the ability to remotely add IPS based on all of our shared websites that have the option set up. So if, say, website a has a bunch of bots hitting it, and our security program logs that and it blocks that IP, well then all the other websites that have that option turned on also block that IP, so all of them are now safe from that IP to tell us what an IP is, in case somebody doesn't know. So the IP, every computer has an IP, every website has an IP. The IP is a numerical sequence that is basically your ID. So you'll see it like you can go ahead, if you are listening from your computer or from your phone, type in what is my IP into your Google search bar or whatever browser you use, and it'll show you a sequence of, I think it's like nine numbers. I don't know. I just see it, and I'm like, that's an IP address. Yeah. Like recognizing a phone number. It's like 139, dot, blah, blah, blah, blah, blah, and that is basically your ID. That's how we track who is who on a website and what is what on a internet platform. I'm looking up how many numbers is. It's 1234567, 234-567-8910, 10, oh, the last four, the last one is four, right? It's three, three. No, no London, because I'm someplace else. Yeah, so, but it has two sets of two numbers and then two sets of three numbers, and that's how my IP address is set up. But either way, you can use it to, like, block your kids from going to specific websites, or your employees. You can use it to stop whole countries from visiting you, right your website. It's actually kind of cool. It's nice. It's a powerful one, and usually we don't block whole countries, unless we have to, yeah, but if we do see a lot of traffic coming from a specific location, then Rebecca will block that specific IP or IP addresses are attached to countries. And so you can this is helpful for sites that serve a very specific, small local area, yeah, or, like even most of our clients are just doing business in the US, and they don't have it outside of it. So if they have a ton of traffic from India, and that's not where they're trying to do business and it's just bogging down their site, we can just block it so that India can't get to the site anymore, and then we don't have to worry about that traffic. And it's awesome. The other thing that we do with IPS regularly is, if you are on your website all the time, then it will register in your analytics. And so when you're looking at your data monthly, you might see a huge number of visitors from your town, but it could be that a lot of them are actually you and so, yeah, we can block the IP address from your Google Analytics, so that way it's not tracking your visits to your website. Or like, yeah. That does happen when we have clients that have a huge office in one location, and we have had clients that have their website as, like, the home screen on a browser, and then there's like, all these hits to the website, and we're like, what? But none of these people use it right? It just like, boom, and it's like, the worst behavior pattern ever, and we can't figure out why. And then we block the IP of the office. And then we realized that it's actually just that they had it. Yeah, there you go. Boom, all right. So, so many fun things. Okay, yeah, tell us. What else? What else can we do? So a couple of just quick things that you can do, also that are more uncommon, though very helpful. This one's actually very common. You should be doing it no matter what you're doing. No offense. Enable two factor authentication. I'm not gonna Yeah, it's so easy for people nowadays to lose their information, just go ahead and add two factor authentication. Because if you can just have a little bit of extra time or space or notification, if someone who does not need to have access to your content, just go ahead, just have it. It's so, especially if you're the only admin exactly, definitely have two factor authentication then, I mean, it doesn't even make sense, not Yeah, because it's just, you do this on your email too. I don't just do it. It's so, so much better have it on, like, all kinds of stuff, yes, but I actually don't mind it. It doesn't even when my bank asks me to enter in 17 numbers, I'm like, I'm kind of annoyed right now. And then I'm like, actually, I'm thankful, yeah, because you can't hack my craft. Yeah? Okay, enabled to FA, enable your enable your two factor authentication. You could also add a content policy, letting people know that you will ban them if they're not following the rules. This is for people who have, maybe, like a blog or a news site, or you do have comments added in. Go ahead and just let people know. Hey, if you start posting content like this, you gotta go where we will block you, whether you're human or not human. Do you think that you could add that as like a checkbox? When people submit a comment like, I understand that if I act like a turd bucket, you're going to block my crap. Oh, you absolutely can do that personally. Yeah, that's super easy, too. That's just a checkbox field, and then you add your whatever wording you need, whether it's yeah, and then you could legally block these people. And while that wouldn't matter if your audience was wholly like, just the general public, like, let's say that you have a membership site, then you know, people might be paying for membership. They they may become disgruntled if you don't allow them to comment, but if you have it clearly posted as a policy, then can't pick up. They can just go on with their bad sales and just be like you are a third bucket. You are canceled. Sometimes you got to treat both bots and people kind of like kindergarteners, there's rules on the board. You break the rules, you're gonna sit in timeout for a bit, unfortunately, and this sucks, but we when we started this episode, we listed off a bunch of things that you can just do that'll automatically call a lot of the bot traffic. But if you are running into problems, it does become a manual procedure, and you will have to continually and manually block the bad humans or bots until it's under control, and then it should, it should dissipate. It really should, yeah. Um, okay, so before we close out, I want you told you told me the other day that people are actually poisoning bots. Yes, the labyrinth. Tell me about this. So not back to get on our little loving horse here, dork trainer, that's doing it's doing it. So basically what they do is they use AI learning to create sort of a how's the best way I can say this, so that everybody understands sort of a list of links that links all back to each other, like an internal labyrinth of just not real pages, but links like a directory. And so this bot goes in and it clicks and it clicks and it clicks and it clicks and it clicks and it gets fed. I can't say that word, bot poison, called Pop poison. Yeah, pop poison. So just what word you were thinking of? Bs, oh, okay, if I don't have to, okay. So it basically takes just all this randomly generated content, and I. It's scraping this just absolute slop scrapes. The slop gets stuck in the labyrinth. It wastes time. It's not bothering your website. It's not bothering someone else, and it's slowly poisoning the algorithm of that bots learning model, which some people might get mad about but when you have lovingly crafted your work, whether that is your website or your written content or your art or whatever you are servicing to people through your website, because I know our clients, they work really hard for the things they do, and they've worked really hard with our team to create a really nice website. And you've got someone out here scraping their stuff and servicing it somewhere else and either stealing their clients or stealing their ideas, or using their ideas and their content and their website to create something that is sub par. Let's go ahead and poison the things that are stealing our stuff. Guys. Make it so they can't be used. It's awesome. They're like, they're like, traps, yeah, trap, ants, trap, ant trap, Monica 36:15 ant trap. Well, it's more like an ant trap, actually, because don't The ants go in and they, like, eat little things, and then they go out, and then they poison the whole colony. Yeah, yeah, that's what it is, ant trap for bots. Okay, so there you have it. How to bounce bots from the bot bouncer herself. And remember, friends, it's not so much a question of if you will have bot problems, it's when Okay, so you don't have to wait until you have problems before you implement some of these suggestions. Save yourself the headache and set up the basics. Now you're going to turn off comments, get the recapture running, and if you do have a plugin, like a forum plugin, you check the honeypot box. Also, if you are accepting comments, use the Kismet or something like it. And then if you run into trouble, remember that you can level up with the manual spam checks. You can block IPs. You can use a CDN. And if you're really fed up, you can block entire countries, or maybe become a professional and learn how to poison bots. I don't know, like, maybe that's your calling in life. It's not mine. I don't it sounds very complicated, so I feel like Rebecca has given us, like a whole arsenal of tricks here. So a huge thanks to Rebecca for sharing her security expertise and not making this sound like a computer science lecture. If you want to learn more about how Rebecca keeps our websites safe, you can check out our safe site [email protected] because I recently revised that whole page and it says all kinds of things out there really pretty now. Oh, it is. It's so pretty. So thank you for tuning in and spending part of your day with us. We know you've got 1700 potentially emails that you should be deleted right now, but before you go, make sure that you subscribe so you don't miss our next episode. We are doing our annual State of the Internet Report, so Rebecca will be back with me again, as well as Stacey and Tyler, and we're recapping everything that changed last year and predicting what's coming next. Last year's predictions came true, what they totally came through true. And I actually, I kind of want to brag about them, so I'm excited to do that. We started doing these state of the internet reports, because we live and breed this stuff, SEO updates, policy changes, algorithm shifts, all of it. But our clients and folks like you, our listeners, you do not always have time to track every single little development while you're busy running your business. So we did the heavy lifting and gave you the highlights that you can actually use to make smart decisions about your website, your marketing and your business. So think of our next episode as your yearly internet reality check. What changed, what matters and what you can just ignore. Yay. So thanks again for listening, and until next time go forth and market with purpose. You boom, boom, boom boom.