A CMS-based site I manage is suffering from a small but ominously growing number of almost certainly bot-emplaced, invisible spam links placed in registered-user-only shoutboxes and user forums. "Link Spam", yes?

Until recently, I've kept my eyes on narrow tech issues, and I'm having trouble understanding what's going on. I understand that we need to tighten up our registration procedures, but more generally...

Do I understand correctly that our primary interest in combatting link spam on our site is that major search engines reduce or zero the search visibility of sites that contain link spam? Although we're non-commercial, we don't want to be at the bottom of the rankings, or eliminated altogether.

Are the linked-to sites the direct beneficiaries of the spam links, or is there some kind of indirection? What is the likely relationship between the link-spammers and the owners of the (directly or indirectly) linked-to sites? Are the owners of the linked-to sites paying the link-spammers for higher visibility? Are the owners aware that this method is being used?

It is my impression that major search engines are capable these days of detecting that given sites are being promoted by link spam, and that these sites may consequently be reduced in search rank or dropped altogether.

Do these sanctions occur frequently? Is there any potential value in sending notifications to the owners of the linked-to sites that their visibility is at risk?



2 Answers 2


Your primary interest in combatting link spam should be preventing your shoutbox and forum filling up with junk, and possibly links to malware. Potentially getting penalised by the search engines is a concern too, but probably a secondary one.

These days most link spam (that I see at least) links to forum-type sites, where the spammer can setup links to the actual beneficiaries of the spam. So the goal is to build some page rank to various throwaway spam pages which they can then use to influence page rank on other sites.

It's quite easy for search engines to detect which sites the spam links to, but they can't know for sure that it's the owners of said site creating that spam (either directly or indirectly). If Google penalised any site linked to by link spam, a company could nuke their competitors from the search engines just by submitting some spam on their behalf. This is why the problem is more difficult to solve than it first appears.

For solving your immediate issue, consider:

  • Adding a CAPTCHA to your sign up form (and/or the shoutbox and forum post forms, at least users who've not posted before)
  • Using something like Akismet to check submissions

possibly both.

  • At the moment the spammer-bots are putting small numbers of hidden links mainly in shoutbox posts. While I'm a bit of a clean-freak, I can't get too upset about the actual crudding up of our site at such low character counts. I'm much more concerned about the effect of the links. I should know about links to malware -- we were hacked two years ago, and our site ended up containing a few thousand links to malware. I'm not certain how hidden links in shoutbox posts would be followed by visitors. ...
    – user5685
    Feb 26, 2011 at 21:32
  • As I said, I know we need to tighten up our registration procedures. The CMS registration procedure already implements a CAPTCHA, but maybe it is being defeated. I need to see if there's a better one available in the latest release or the add-ons. Thanks for the explanation about what Google can and cannot do, and the possibility of sabotage. This is very complex stuff! I'm spending much more time worrying about such things than about the actual content of our site. I already looked at Akisment, but as yet our CMS isn't supported -- so I may be the one to do it. Roll up my sleeves...
    – user5685
    Feb 26, 2011 at 21:32

If you use a popular opensource software to power your forum try switching the URL for the registration page most people use defaults for their sites so most spambots look for defaults IE if you installed your site and it uses site.com/register as the registration page change it to site.com/why-not-create-an-account most bots will look for domain/register and if it's not there move on to another site. Additionally you can create levels IE you must make 10 posts before you can post a link.

  • Good tips, but be careful about editing core files that can make upgrading to newer versions problematic. And if you change the location of the registration page, you'll want to make sure all of your internal links/redirects are updated. Feb 26, 2011 at 4:56
  • A great idea! Yes, it's an open-source CMS, and yes, it ought to be a very simple mod. Easy to play some further games, too. My guess is that eventually, the people specializing in attacking this particular CMS will adapt, but that will take some time. There may be add-ins for this CMS that require 'n' posts before posters can include a link. I've read that recently there's a pattern of posting multiple innocuous posts before including hidden links, and I think we've seen exactly that. So I'm wondering if this is a good direction.
    – user5685
    Feb 26, 2011 at 21:33
  • I was just about to add to my above comment just above that I'm very reluctant to mod a standard product because of potential (likely!) maintenance/upgrade issues. I'm already a bit nervous about upgrading in the first place, as this particular CMS doesn't have a tradition of strong, well-document upgrade procedures.
    – user5685
    Feb 26, 2011 at 21:33
  • @hen3ry there are very few things you can do to get around advanced spammers, the bulk of spam however, seems to come from folks that are just interested in picking up the low hanging fruit. If you do a search on Google for "auto post +your cms" you'll likely find a tool or two that are sending 90% of your spam. Then it's a matter of looking at the features and building something that prevents that tool specifically.
    – Joshak
    Feb 28, 2011 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.