Maria’s Guides

I install Bad Behavior and get another tip from its author.

I never quite understood why I would use an excellent and powerful spam prevention tool like Spam Karma with another spam prevention tool called Bad Behavior. I’d been using Spam Karma on its own since I started moving my sites to WordPress last January and it was doing a kick-butt job of keeping my site comment-spam free — over 50,000 individual comment spams caught in the past eight months. Only about a dozen comment spams slipped through during the same period, and they were easy enough to delete manually. I didn’t think I needed anything else.

But Miraz also uses Bad Behavior on her blogs, so I figured there must be something about it that I was missing out on.

Then I moved all my WordPress-based sites to GoDaddy.com. That’s when I was introduced to GoDaddy’s limitation on concurrent database hits: 50 per MySQL database. My introduction came as a WordPress error screen that said my database could not be accessed when I attempted to load a page on MariaLanger.com. Another try moments later and it worked. I figured that MariaLanger.com and wickenburg-az.com, both of which get over 1000 visits a week, we most likely to hit that limitation. This was a problem.

I use a plugin called WP-UserOnline to monitor current access to the site. The software displays registered users (normally just me), guests, and bots from legitimate systems like Google, Technorati, and MSN (for example). It also tells me the maximum number of users online at once: 50 on MariaLanger.com just a week or so ago. But it doesn’t tell me about the spam bots — automated programs that go online for the sole purpose of filling my posts with comment spam. Spam Karma stops the spam, but not before the spam bot gets online and tries to post it. With literally hundreds of spam messages caught and discarded every day by Spam Karma, it was likely that spam bots were accessing my database along with users, filling up my 50 access spots.

When my sites were running on my own computer, there was no limit to the number of concurrent hits to my mySQL databases. So I didn’t really care about spam bots. But now I had a limit and was starting to care very much.

So I looked at Bad Behavior again. It claimed to prevent spam bots from even getting online at my site. Surely that would prevent database hits. It was worth a try.

I installed Bad Behavior per the online instructions. Then I read the Read Me file. It said it didn’t work with GoDaddy.com. I wondered about that. This was a new version (2.0.6) and that Read Me file might not be up to date. So I decided to risk it to see what would happen.

What happened is that it worked. In less than 24 hours, in fact, it has stopped more than 200 spam attacks on just one site.

I wrote to the author of the software, Michael Hampton, certain that I was missing something. Perhaps Bad Behavior and GoDaddy’s settings were fighting under the hood, causing database corruption, etc. But he wrote back to say that GoDaddy.com had probably fixed the settings problem that was causing the incompatibility. It worked because the problem was gone.

Great!

I used the Donation link in the Bad Behavior Administration panel to send the author a few bucks. (Lunch on me, is usually how I phrase it.) In the comments area, I mentioned how well it was working and my concerns about database hits. Michael responded with even more useful information:

Bad Behavior runs as soon as possible during WordPress’s page load, which cuts database access to a minimum. There shouldn’t be more than a couple of queries run by the time Bad Behavior loads.

Another thing you can do to reduce database queries is to enable the WordPress object cache, which is disabled by default. You can do this by inserting this line somewhere in the middle of your wp-config.php file:

define('WP_CACHE', true);

Then WP will cache some common database queries in files on disk, where they won’t generate future database accesses (unless the data changes, of course).

Thanks for your support!

Thank you, Michael, for this useful tidbit!

I’ll institute that today and see how it works. In the meantime, I’m pleased at the performance of the Bad Behavior/Spam Karma pair. And now I understand why Miraz also uses both.

Footnote (added September 21, 2006): I added the above code to my wp-config.php file and got all kinds of error messages. I suspect that it’s because permissions aren’t set up correctly in my wordpress folder. If you try it and everything goes bad, simply remove the inserted line and resave the wp-config.php file. Will provide an update if I have time to troubleshoot the problem. In the meantime, Bad Bahavior has blocked over 500 access attempts in just a few days. Not bad, huh?

Technorati Tags: GoDaddy.com, hosting, howto, plugin, website, WordPress