Keeping Evil Bots Off Your Blog
While Spam is a nuisance, the real problem is keeping all those non-search engine bots that are always up to no good from crawling your blog in the first place. Why are you letting bots designed to take advantage of your blog use up all your bandwidth? Blogs should be for human visitors and for those search engine bots who will eventually be driving traffic back to your blog, and for nobody else.
The Bad Behavior Plugin
John H. Gohde reviews the popular Bad Behavior plugin, version 2.0.24, by Michael Hampton in this post.
Unfortunately, the plugin author gives a horribly bad writeup on his Web site which is as clear as mud. But, basically Bad Behavior is an anti-bot plugin that is available for more platforms then just WordPress. It feeds off of, or works because it uses the blacklist or database that is being maintained by Project Honey Pot. In fact, Bad Behavior wont work at all unless you first obtain a Project Honey Pot Access Key.
Bloggers are able to customize it by adjusting two different parameters: Threat Threshold and Age of Blacklisted Data. And, then you are further given a Strict Mode option which purports to make Bad Behavior even more aggressive.
In short, straight out of the box, Bad Behavior is by default set up to be more aggressive than the Project Honey Pot plugin which does basically the same thing: Block Access to All Evil Bots by way of Project Honey Pot’s blacklist database. Thus, by setting the date parameter to 14 and the threat level to 30, with a non-strict mode the aggressiveness of both plugins should be comparable. But my tests revealed that even with Bad Behavior toned down it is considerable more aggressive than the Project Honey Pot plugin. Which is basically what you want. Something that is actually going to block quite a few bots from accessing your blog.
Bad Behavior is Bad on Logging
Even though the plugin claims to be able to do so, John was unable to get Bad Behavior on his theme to log only what was blocked. Bad Behavior’s logs get very voluminous and apparently are designed to go on forever, as the plugin gives you no built in option that will delete the log files. You have to click on the Show Blocked hyperlink before you can easily tell whether the plugin is working or not. But John was able to use the WP DBmanager plugin that was previously reviewed to empty the wp_bad_behavior table where Bad Behavior keeps its logs. This will also reset the total blocked count back to zero.
Bad Behavior Gets the Job Done
Want as many bots caught as possible? Then leave Bad Behavior’s default options in place, or even tighten them up some more. Concerned about too many false positives? Then cut back on the threat parameter by making the number larger than 25. And, do not use the strict mode.
