Anti-spam

From Linkwiki
tbd @

Background

This page aims at helping administrators of other MediaWikis to combat automated spam, while minimizing the inconvenience experienced by legitimate users.

It does not cover vandalism, trolling or similar actions by human users, although some tool mentioned here (especially Extension:AbuseFilter) might help with those too.

Hilfe:Anti-Spam contains an overview of the systems deployed at Wiki Aventurica.

Type of Wiki

Before deciding on anti-spam measures, one needs to consider how open the wiki should be. Should anonymous edits be possible? Who should be able to create new accounts?

Type Notes Localsettings.php
anonymous users are allowed to edit this is the MediaWiki default; if no anti-spam measures are taken, the wiki will soon be flooded with spam
only user accounts are allowed to edit, but account creation can be done anonymously measures against automated account creation are necessary, otherwise spam will be flooded into the wiki via user accounts 
$wgGroupPermissions['*']['edit'] = false;
account creation is restricted to existing users / sysops this configuration prevents spam, but every new user account needs to be created by an existing account account creation restricted to sysops: 
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;

account creation possible for existing users: 

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['user']['createaccount'] = true;

Anti-spam tools

Prevention of User Account Creation

Tool Usage Notes Local pages Localsettings.php
Manual:$wgInvalidUsernameCharacters prevents creation of accounts with names typical for spammers It is very typical for spambots to include numbers into the username of the accounts they try to create (matching typical behavior of humans faced with choosing an account name), or to write a sentence (using punctuation marks). This variable takes that away; the wiki UI does need to communicate this to the user though, MediaWiki:Createacct-helpusername is a good place to put a link to a page explaining the rules. 
$wgInvalidUsernameCharacters = '@:>=#€,!?.1234567890';
Manual:$wgMaxNameChars prevents creation of accounts with long names In some cases spambots try to create accounts with names that contain their spam message, and thus that name gets very long. This variable restricts the length of the username. 
$wgMaxNameChars = 50;
Manual:$wgAccountCreationThrottle prevents creation of too many accounts from one IP If a bot breaks the barriers to account creation, this variable makes sure that it can't create too many. Against a botnet this only has a very limited effect though. 
$wgAccountCreationThrottle = [ [
	'count' => 1,
	'seconds' => 86400,
] ]; #every IP max 1 account per 24 hours
Extension:ConfirmEdit prevents creation of user accounts by bots This extension can be configured to use a number of modules. Do not bother trying out any but "Turnstile", because in the age of LLMs the others are broken easily. You will need a user account at cloudflare though.

In order to keep the inconvenience for legitimate users to a minimum, it is advisable to only require a captcha during user account creation, and only for users who are not "autoconfirmed". It is possible to protect other actions too though. 

wfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/Turnstile' ]);
$wgCaptchaClass = MediaWiki\Extension\ConfirmEdit\Turnstile\Turnstile::class;
$wgTurnstileSiteKey= '<your key here>';
$wgTurnstileSecretKey= '<your key here>';
$wgGroupPermissions['autoconfirmed']['skipcaptcha'] = true;
$wgCaptchaTriggers['edit'] = true;
$wgCaptchaTriggers['create'] = true;
$wgCaptchaTriggers['sendemail'] = false;
$wgCaptchaTriggers['addurl'] = true;
$wgCaptchaTriggers['createaccount'] = true;
$wgCaptchaTriggers['badlogin'] = true;
$wgCaptchaTriggers['badloginperuser'] = true;
$wgCaptchaTriggers['contactpage'] = true; #Extension:ContactPage
$wgCaptchaBadLoginAttempts = 3;
$wgCaptchaBadLoginExpiration = 3600; // 3600 seconds = 60 minutes
$wgCaptchaBadLoginPerUserAttempts = 3;
$wgCaptchaBadLoginPerUserExpiration = 3600; // 3600 seconds = 60 minutes
$wgRateLimits['badcaptcha']['newbie'] = [ 10, 600 ]; // 600 seconds = 10 minutes

Prevention of Article Editing

Tool Usage Notes Local pages Localsettings.php
Manual:$wgAutoConfirmCount prevents new accounts from getting abusable rights instantly This variable configures how many successful edits are needed for the account to be automatically promoted to "autoconfirmed". Combined with an AbuseFilter which prevents non-"autoconfirmed" accounts adding links, this can reduce spam. 
$wgAutoConfirmCount = 1;
Extension:AbuseFilter can be configured to prevent any action This extension is a powerful tool, which will, if configured well, block almost 100% of automated editing spam. It does not contain any default filters though, and thus configuring it falls to the administrator of the wiki. Special:AbuseFilter 
wfLoadExtension( 'AbuseFilter' );
$wgAbuseFilterActions['throttle'] = true;
$wgAbuseFilterActions['warn'] = true;
$wgAbuseFilterActions['disallow'] = true;
$wgAbuseFilterActions['blockautopromote'] = true;
$wgAbuseFilterActions['block'] = true;
$wgAbuseFilterActions['rangeblock'] = false;
$wgAbuseFilterActions['degroup'] = false;
$wgAbuseFilterActions['tag'] = true;
$wgAbuseFilterActions['showcaptcha'] = true; #Extension:ConfirmEdit
$wgAbuseFilterEmergencyDisableThreshold['default'] = 0.50;
$wgAbuseFilterEmergencyDisableCount['default'] = 100;
$wgAbuseFilterLogIPMaxAge = 7 * 24 * 3600;
$wgAbuseFilterLogPrivateDetailsAccess = true;
$wgAbuseFilterPrivateDetailsForceReason = true;
Extension:SpamBlacklist prevents spam links in article content This extension blocks any edit adding links which match a regex line in the deny list. Moreover, this extension blocks emails which match regex line in the email deny list from being used for the creation of user accounts or the sending of emails. MediaWiki:Spam-blacklist: deny list
MediaWiki:Spam-whitelist: allow list
MediaWiki:Email-blacklist: deny list for emails
MediaWiki:Email-whitelist: allow list for emails 		The SpamBlacklist of the MetaWiki is automatically being used. 
$wgLogSpamBlacklistHits = true;
$wgGroupPermissions['sysop']['sboverride'] = true;
Extension:SpamRegex prevents spam in article content This extension blocks any edit adding text which matches a regex line in the deny list. Moreover, this extension blocks edit oder move summaries which match a regex line in the deny list. Special:SpamRegex
Extension:TitleBlacklist prevents spam in article names, file names, user names This extension blocks the creation of pages with names which match a regex line in the deny list. Those regex lines can also have attributes specifying when they should deny an action, see Extension:TitleBlacklist#Usage. MediaWiki:Titleblacklist: deny list
MediaWiki:Titlewhitelist: allow list 
wfLoadExtension( 'TitleBlacklist' );
$wgGroupPermissions['sysop']['tboverride'] = true;

The name of the deny list can be configured: 

$wgTitleBlacklistSources = [
    [
         'type' => 'localpage',
         'src'  => 'MediaWiki:Title-denylist'
    ]
];

Prevention of Mass Inquiries

With the rise of LLMs, texts written by humans became valuable, and thus large botnets now mass request wiki pages, special pages, revision differences and old revisions of wiki pages, impairing server performance for legitimate users in the process.

There are two ways to combat this:

  1. Restrict anonymous viewing of certain special pages, old revisions and revision differences. The requests will still come, but the performance impact will be lowered.
  2. Identify and block IP ranges of mass-requesting botnets by using the firewall. The bot requests originating from blocked IPs will remain unanswered by your server.
Tool Usage Notes Local pages Localsettings.php
Extension:Lockdown restricts access to some special pages, actions or namespaces to certain user groups The extension does not block the request, it just prevents the content from being shown. The bot does not get a 403 error, and thus probably will keep requesting pages. Still, it improves the performance of the server. 
wfLoadExtension( 'Lockdown' );
$wgSpecialPageLockdown['Mostlinkedtemplates'] = [ 'sysop' ];
$wgSpecialPageLockdown['Allpages'] = [ 'autoconfirmed' ];
$wgSpecialPageLockdown['Categories'] = [ 'autoconfirmed' ];
$wgSpecialPageLockdown['Recentchangeslinked'] = [ 'autoconfirmed' ];
$wgSpecialPageLockdown['Prefixindex'] = [ 'autoconfirmed' ];
$wgSpecialPageLockdown['Whatlinkshere'] = [ 'autoconfirmed' ];
$wgSpecialPageLockdown['Wantedpages'] = [ 'autoconfirmed' ];
Handling web crawlers#Custom PHP restricts access page diffs This code sends a 403 error to anonymous users requesting a page diff. 
$wgHooks['MediaWikiPerformAction'][] = function ( $output, $article, $title, $user, $request, $wiki ) {
	if ( $request->getVal( 'diff' ) && !$user->isRegistered() ) {
		$output->addWikiTextAsInterface( "'''You must be logged in to view page diffs.'''" );
		$output->setStatusCode( 403 );
		return false;
	}
};

Cleaning up

Tool Usage Notes Local pages Localsettings.php
Manual:RevisionDelete deletion of page revisions The revisions of existing pages which got flooded with spam can be deleted by users who are in a group which has this permission. 
$wgGroupPermissions['sysop']['deleterevision'] = true;
Extension:Nuke mass deletion of pages If a wiki got flooded by spam, and appropriate preventive measures have been taken, this extension enables sysops to clean up the mess. It does not help though if already existing pages were edited by the bots. Special:Nuke
Extension:User Merge and Delete deletion of user accounts This extension enables users with the "usermerge" permission to delete user accounts by merging them with another account. Simply create User:Spam and merge all the accounts created by spambots into it.
It is advisable to restrict this permission to bureaucrats. 		Special:UserMerge 
wfLoadExtension( 'UserMerge' );
$wgGroupPermissions['bureaucrat']['usermerge'] = true;
$wgUserMergeProtectedGroups = [ 'sysop' ]; #optional - default is 'sysop'

It is a good day to die.

-- Klingon Warrior, facing overwhelming odds

Retrieved from "https://links.blauparadiesvogel.de/w/index.php?title=Anti-spam&oldid=634"