Debugging comments: Nope, its Dam Spam

I previously wrote about some adventures I was having with visitors to my site being blocked while attempting to post comments. I had a hypothesis at the time that the problem was related to a Cloudflare feature called Browser integrity check (BIC). However, I believe I’ve now disproven that as the (primary) cause: the real culprit appears to be a plug-in for WordPress called Dam Spam.

The counter evidence

I had two sources of contrary evidence regarding my Cloudflare BIC hypothesis after I disabled the feature:

1. Comments were still blocked for some users: notably Krikket using Chrome and my friend Chris likewise using Chrome
2. The BIC error messages I was referencing: the Cloudflare logs showed messages reflecting client IP addresses in the 34.x.x.x and 35.x.x.x range, neither of which are common and both of which belong to Google in whole or substantial part. Also the target resources were image files unrelated to commenting. Note that the BIC messages stopped appearing in the logs entirely as expected when I turned the Browser integrity check feature off

Looking again

I looked more closely at the error messages people were seeing when their comments were blocked, in particular Chris’ example:

Chris’ example prompted me to do another google search on the exact phrase that appears in the message i.e.: “You have been blocked from entering information on this site”. Unlike my previous attempts the particular query I used brought up a Google AI reference to Stop Spam i.e. this quote:

The error message “You have been blocked from entering information on this site” is specifically generated by the Stop Spammers WordPress plugin (formerly known as Stop Spammer Registration). This happens when your IP address, email, or browser footprint triggers the plugin’s aggressive anti-spam algorithms during a form submission or login attempt. 

Stop Spam is the old name for a plugin I am using called Dam Spam, a plugin that fairly aggressively blocks form and comment spam based on rules it sets. I disabled (deactivated) Dam Spam and my friend Chris tried to post a comment again, this time successfully. He tells me it is the first time he’s been able to post a comment in two years! If nothing else I count his return to my comments as a win making debugging this problem worth the effort.

Conclusion

Dam Spam appears to be far too aggressive in whatever rules it is using for comment spam blocking. Although Dam Spam is highly flexible and customizable, it leans heavily towards blacklisting which makes re-writing its rules rather daunting at this time. I won’t be turning it back on during Blaugust other than possibly to test a few things briefly.

Disabling Dam Spam does leave my site more vulnerable to various spam sources, but I’m going to watch for evidence of that kind of thing. Akismet and WordPress in general have progressed in the anti-spam domain since I first started using additional third party tools and it may be that I can do without.