Guestbook moderation and spam

Guestbooks are a favourite target of spam bots: an open form, no login, and a page that search engines read. UltraGuest is text only (no uploads, no images), which already removes a lot of trouble, and the rest is handled in two layers: protection that every guestbook gets without doing anything, and moderation tools you switch on yourself in the Control Panel.

What every guestbook gets automatically

A human check on every post. The sign form includes a Cloudflare Turnstile challenge, which stops the plain bots that used to flood guestbooks. For most visitors it needs no more than a click.
No links in messages. Almost all guestbook spam exists to spread links, so a message containing an http:// or https:// address or a link tag is refused with a short explanation, and a name cannot contain a link either. Visitors can still leave their e-mail address, which only you see.
Rate limits. One address may post at most 20 times per hour to a guestbook, the same message cannot be repeated within five minutes, and a guestbook that has already received 40 posts in a day takes no more until the next day (the busiest genuine guestbooks peak at around 25).
Campaign detection. The same text posted to eight or more guestbooks within a week is treated as a spam campaign, whatever it says: further copies are refused and the earlier ones are removed.
Content rules. Every post is checked against rules for illegal material and the usual junk: drug and pharmacy spam, fraud and scam testimonials, hate propaganda, piracy, adult advertising. Recent posts are re-checked every six hours and everything is scanned once a week, so a new campaign that slips through is gone within hours.

What you can switch on

Approve new messages (Settings › Guestbook Options). New posts are held as Pending and appear only after you set them to Public under Messages › Pending › Edit Message. This is the safest setting for a guestbook that gets a few messages a week.
Word filter (same page, recommended). Messages, names and e-mail addresses containing common obscene or pharmacy terms are refused.
Private messages. Visitors can tick "Private" and the message is shown only to you.
Block IP addresses (Settings › Security, or the "Block IP" link next to any message). Useful against one persistent poster; keep in mind that addresses change and that other people may share one.
Edit, hide, trash, delete. Any message can be edited, moved to Hidden or Trash, or deleted for good under Messages.
Notifications (Settings › Email Notification). Be e-mailed at once about new public messages and, separately, about private messages and messages waiting for approval, so nothing sits unnoticed.

Reporting abuse

Every guestbook page carries a "Report abuse" link that opens the support form with the guestbook's id filled in. A person reads every report. Content that breaks the Terms of Service or the law is removed and the guestbook can be disabled; material that sexually exploits children, and advertising for it, is removed and reported to the National Center for Missing & Exploited Children as United States law requires.

Privacy while fighting spam

None of this involves tracking. Guestbook pages set only the session cookie needed to post safely, and visitors who merely read are counted, not identified. When a post is refused or removed by a rule we keep the date, the guestbook, the rule's name and the posting IP address, never the text, for 400 days. A poster's IP address is visible to the guestbook owner only. The full picture is in our privacy commitments and the Privacy Policy.

See also: how to add a guestbook to your website, the FAQ and the features. Not on UltraGuest yet? Sign up for free.