Welcome to WebmasterWorld Guest from

Forum Moderators: rogerd

Message Too Old, No Replies

vBulletin Feature Leaves Forums Open to Link Spam

5:02 pm on Aug 20, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member wheel is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Feb 11, 2003
votes: 11

Most link drops inside forums these days are nofollowed, which means no link love from the search engines. (so why these people keep autospamming my forum is beyond my comprehension).

However I just noticed on a site running some popular forum software that the 'visitors' tab in the member profile section allows members to post messages to other members. And link drops on those pages do not contain the nofollow tag. Is it that way on other sites using this forum software? I haven't checked (no, it's not this site).

Personally I don't have time for nonsense like this. But I'm sure with some innovation you and your friends could set up accounts on a wide variety of forums and cross post URL's to each other's member profile. Probably wouldn't even run afoul of the admin's, because who'd even be checking that.

There you go, a link building loophole for y'all. I wouldn't touch this with a ten foot pole.

If you did 10K of these, would you rank? Maybe. Would you rank in 6 months? Maybe not. I'm pretty sure it wouldn't pass a hand check.

5:51 am on Aug 21, 2009 (gmt 0)

Administrator from JP 

WebmasterWorld Administrator bill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month Best Post Of The Month

joined:Oct 12, 2000
votes: 49

You can control this feature in Default Registration Options, User Profile Options, and User Profile: Visitor Messaging Options. There are a lot of options to fine tune whether this feature is even available to your forum's members. Depending on your individual forum's settings this may not even be turned on.

vB has a lot of ways that the forum administrator can control what is posted in the Visitor Messaging portion of the user's profile. I doubt that vB is going to do much to fix this. However, I think it's important to let webmasters who run vB forums about this new tactic.

It's easy to switch off or hobble this feature. If you're really concerned, but still want this feature, then just enable Limit usage of Visitor Messages to Contacts and Moderators in the Default Registration Options, and new members won't be vulnerable at least. Users can still change this setting in their profile to open up commenting to Everyone, which appears to be the default setting for this feature.

7:48 am on Aug 21, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Mar 4, 2004
votes: 0

I don't use VB but can't you just deny it with robots.txt?I deny everything on my forum except the content..

In phpBB by default bots do not have access to profiles, memberlist or any of the other non content or personal type pages. There's a special group for bots with their own permissions.

9:40 am on Aug 21, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 5+ Year Member

joined:July 29, 2007
votes: 9

Links in posts are not the only places to find spam. As you mentioned some non post locations allow it.

I just wanted to point out a couple of other ways spammers abuse forums.

- they register, leave a link to their site in their profile and never return (and search engines do find these).
- they abuse the forum PM ability by sending messages privately.

and by far not the least damaging reasons...
- they use a bot to register all over the place so that they can gather an email address list to sell (which your forum kindly provides them with when they register)
- a twist on the above is that they can take the header information from your forum email, compile a list of other member emails (from profiles or memberlists), and spam them as if it was you doing it.
- another twist on the above, damage your forums credibility (perhaps its a competitor) by using your own email address to get your site onto spamming blacklists.

Forums provide a lot of value for spammers if not properly locked down.

10:52 am on Aug 21, 2009 (gmt 0)

Preferred Member

10+ Year Member Top Contributors Of The Month

joined:Mar 12, 2004
votes: 12

Seems a little unfair to single out vBulletin unless you have carried out extensive research and found no other forum software could possibly be abused by spammers.

Having done my own research I find I can configure vBulletin to virtually eliminate spam registration or posting.

I don't allow guests to access visitor profiles on my forums. Also I don't have visitor messaging enabled. Problem solved.

My preference is not to use nofollow. Once a forum has been tweaked to remove spam problems, and assuming it is monitored, any links genuinely will be recommendations from trusted members. So why should they not pass google juice?

11:45 am on Aug 21, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 5+ Year Member

joined:July 29, 2007
votes: 9

vordmeister, I don't think the intent was to single out vbulletin, while working on vbulletin it makes sense to refer to it specifically. All forum software not written by Brett is indeed flawed to varying degrees.

So why should they not pass google juice?
- some likely should but they also need to be monitored for volume, relevancy etc. They do affect the dynamics and link structure of your site by just being there.
- Google can get to the new posts faster than a human can if a ping occurs, one rotten link can do damage.
- such a forum is the honey that will eventually be found by spammers crafty enough to bypass your efforts.

12:10 pm on Aug 21, 2009 (gmt 0)

Administrator from US 

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 21, 1999
votes: 11

This is not just a vB issue. Most of the forum software on the web does not support nofollow.

If you are a php programmer, the fix is about 30 seconds. In fact, could a vb operator post a fix for it right here? Change to what script - where?

From vB/Internet Brands:

1.To enable the “nofollow” attribute, go to [Settings] -> [Options] -> [BB Code Settings] -> [Add nofollow attribute to URL BB Code].
2.In the BB Code Settings, you can also set URL nofollow domain Whitelist.
3.You can also disable any links posted in Visitor Messages by going to: [Settings] -> [Options] -> [User Profile: Visitor Messaging Options] -> [Allowed BB Code Tags in Visitor Messages]. Uncheck “Allow Link BB Code”