If you have a cart, a content management system, a guestbook, a forum, or a blog, you’ve probably encountered the problem of spam. If you have not, you will, if you ever operate those, or any other dynamic websites.
See, here is what happens when you have a form on your site that allows someone to register, send information, post a listing, contact you, etc:
1.Malicious bots are programmed to trawl the web, looking for sites with vulnerabilities. They look for any way to take advantage of your site – one may be programmed to spam, another to abuse a form, another to look for more serious security holes. Some do more than one thing.
2.When they find a site with the type of form they are looking for, they try to take advantage of it. If they fail, they move on. If they succeed, it sets up a chain of events.
3.The bot will proceed to exploit whatever opportunity it found. It may be a weak form, a site that does not have moderation turned on, etc.
4.If it succeeds once, then it marks your site as a target. It is important that you understand that these bots only check ONCE for a hole. If they find it, they will exploit it, and they will keep hammering your site even if you DO install some kind of protection later. Once you are found, the damage is done. This means that if you leave your comments unmoderated, and a bot finds it, and starts plaguing you with spam, it will NEVER STOP. Even if you set the comments to moderated. It will still keep sending you stuff that you have to clean out. Some bots can even break through moderated comments to auto-post. And they never go back to check again to see if it is still working, they just hammer away in the background. They can be unbelievably aggressive, and it just wears on you to try to fight them.
5.In order to get them to stop, you have to do one of two things: You can install something to stop them (which doesn’t really stop them, it just makes it so you can see them anymore), or you can move your site. If you move it where any links still lead to it that lead them there before, or if you move it on the same domain, they’ll find you again within a few hours, because while bots are not programmed to check to see if posts are going live after that first check, they ARE programmed to look if your page disappears.
The first rule then, is to prevent from the start. That means turn ON comment moderation, or post moderation, or registration approvals. Don’t EVER allow a site to operate where someone can register without confirming an email address, or where they can post a comment without someone having to approve it before it goes live. If you do, you are asking for someone to come in and take over your site. If you want it to be valuable to you, you have to keep control of what goes on it.