Blog Azeroth

I use Conditional Captcha with Akismet. You have to use Conditional Captcha in conjunction with Akismet or another spam blocking program - it does not work on its own.

Here's how it works:

1) Akismet asks "is this spam?" If Akismet determines that the comment is not spam, it is let through (or held in moderation, depending on whether you are moderating comments) If Akismet thinks the comment IS spam:

2) Conditional Captcha says "fill out a captcha." If you fill it out correctly, the comment goes through (or to moderation). If it is not filled out correctly, the comment is trashed.

What this means?

- MOST of your commenters will never see a captcha. If Akismet doesn't think they're spam, they will never know the difference.
- Legitimate comments will never get caught in spam. If someone is flagged as spam but then is able to fill out a captcha, the comment goes through. Therefore, you don't have to spend time looking in your spam folder for real comments.

Since I have installed this, I have gotten NO false positives (no legitimate comments have been sent to spam filter) and very few spam comments have gotten through.

Until recently I was ok with just skimming my spem queue once a day, but in the last couple of weeks I started getting a much greater volume of really long spam comments (50+ a day, I'm still a small blog), so I followed your advice and installed Conditional CAPTCHA.

I wanted to add my recommendation if anyone's uncertain. If you use Akismet it's really easy to install, and it'll save you so much time once you get to trust it. You can set it to Trash your spam rather than deleting it permanently, so you can still go through and check it for a while.

The only small problem I have with it is that if you happen to get the CAPTCHA wrong by mistake you don't get an error message or another chance, it just silently fails you and redirects to the post page. Maybe it's just me, but I get CAPTCHAs wrong from time to time, and I am (obviously) a human, so I think I'd prefer some feedback to be given so I know whether I'm being moderated or I've been deleted or I should try and resubmit.

Thanks for the recommendation!

Oh, I hadn't thought of the issue of getting the captcha wrong. I actually use it with the recaptcha module (requires registration but nothing else).

I have it sent to my trash rather than just outright deleted, and I haven't found a legit comment yet.

To combat spam, I also close comments on any post older than 60 days. I like people to be able to comment on older stuff (some bloggers close it after 14 days), but spammers also target older stuff. Also, if I notice a particular post getting spam-pingbacks, I'll just close pings on that post. I'm not sure what causes a post to be flagged for fake-pings, but when a post is, a huge number come pouring in.

I use reCAPTCHA too, it's better than some, definitely.

As an extra thought, just requiring the CAPTCHA has slashed my spam by a huge amount anyway, I guess most of the bots don't even try to complete it. That's worth it in itself, and it's easy enough to pick through the remaining handful of comments.