Add a hidden field and a layer of validation service to prevent spam comments enough

Is enough to prevent spam comments, depending on where the spam comes from. Place a hidden honeytrap field on the form and add a layer of validation service, which can eliminate a large number of script submissions and robots that automatically fill in forms, but cannot stop human or semi-automatic messages disguised as normal questions that contain promotional contact information - this part needs to be filtered by content side and manually reviewed. Therefore, these two layers are necessary but not sufficient. The complete division of labor for preventing spam comments should be three layers: the entry layer intercepts the submission method, the content layer intercepts the text itself, and the background layer keeps a verifiable record of handling.

Who does each layer intercept

The hidden field is not sensitive to real people because it does not interact with normal fillers; its scope is narrow but the cost is very low. The scope of the verification service is wider, but the cost is that the judgment rules are not in the hands of the site, and the site can only see the results, so it relies on its own logs to check the effect.

Why should we still look at the content itself

The fastest growing part of the garbage comments is not the long promotional string that is 'one look fake', but the short text disguised as a question or thank you with a contact number at the end. This type is completely normal at the entry level: the fields are filled correctly, and the interaction has passed. There are only two ways to stop it - content filtering and manual review.

AnQiCMS' content security settings handle sensitive word filtering and keyword replacement with known word lists, intercepting or replacing on hit; content review handles unknown expressions, relying on human judgment. The value of the combination lies in: the word list is responsible for high-frequency repetitions, while manual work is responsible for new variants, and neither needs to handle all comments.

How to enable these three layers in the background

It is recommended to follow the order of 'record first, intercept later'. The first step is to clarify the entry status of comments and attachments, the background guestbook list can see the current status of each comment, which is the basis for all acceptance data. The second step is to enable the form side captcha verification, that is, reCAPTCHA integration, to suppress automated submissions. The third step is to configure sensitive word filtering and keyword replacement, covering the word list to the known promotional expressions. The fourth step is to fix the rhythm of manual review, making the state transition into a routine rather than a temporary action.

Doing it backwards will cause problems: first intercept and then record, once a normal user is mistakenly intercepted, there is no baseline for comparison to judge whether the interception is too broad.

What is used for acceptance after going online?

Acceptance depends on the status rather than the feeling. The document status is divided into formal documents, drafts, to be published, and recycling bin. On the comment side, it should also be able to filter by status: the amount of backlog to be published reflects the interception effect, and the amount moved to the recycling bin reflects the risk of mistaken interception. It is fixed to look at these two quantities once a week, which is more significant than looking at the total amount every day.

Another point to pay attention to is the intercepted samples that slipped through. The comments that were 'published but reported later' should be counted separately to supplement the word list -- this is the reason why sensitive word filtering can remain effective. The word list should be updated by actual slipped-through samples.

Common questions

Is it enough to only upload hidden fields?

It is sufficient for pure script batch submissions, but not enough for other purposes. Hidden fields are the cheapest layer, usually used as a starting point rather than an endpoint.

With the verification service, do we still need manual review?

Yes. The verification service determines whether the submission is automated, but does not judge whether the text content is compliant. Promotional text and inappropriate expressions still need to be handled by the content side.

How to judge whether the interception is too wide

Look at the cost of false interception: the amount of pending releases suddenly increases while the feedback from normal users decreases, usually indicating that the rules are too tight. At this time, it should go back to the message list and check the samples by status, rather than directly relaxing all the rules.

Can sensitive word filtering replace anti-spam strategy

No, it is a word list mechanism, which only covers known expressions. New variants and disguised promotional texts as normal questions need to be discovered through manual review and then added to the word list.