Banning spambots

[Zygoot]

Since last week I'm having lots of troubles with comment spam bots. First I tried banning their IP addresses but this this didn't work. I banned more than 40 IP addresses but still I get flooded with spam because it looks like they always use different proxies.

Then I found a way to stop comment spammming, by implementing some extra security, but now they can still access my website and eat up lots of bandwidth.

Does anybody have an idea how I can successfully ban them? All those comment spam bots only seem to have one thing in common, their fake referrer [google.com...]

[jdMorgan]

"Banning them" does not stop them from making requests to your server. That can only be done with a sophisticated (hardware) firewall.

One way to limit the bandwidth they consume is to do something like this:

Internally rewrite all 'banned' comment-spammer requests to a new subdirectory.

In that new subdirectory, add an .htaccess file.

In that .htaccess file, define a new custom 403 ErrorDocument.

Also in that .htaccess file, deny access to all pages except the error documents.

Make the new 403 error document as short as possible while still validating.

Using this new short error document will reduce the bandwidth they consume.

In most cases, your domain will be removed from their lists after you feed them a constant stream of 403-Forbidden responses. It can take several months, though.

Jim