Users are allowed to post on our website and we have started to get some spam. We have a background process that removes most of them after a few minutes, but are integrating a better solution that blocks on ingestion. This way they never make it to the site.

My concern is that if we give them a big “we’ve detected spam” error, they’re going to keep trying until they eventually get through. Our background process likely wouldn’t pick up this new spam either, and now we’re in an even worse state.

What’s the best convention for dealing with these posts? Just pretend that it posted and silently fail? Show a more generic error message?

  • Any response message will likely not be read by anyone since these things are typically automated. Pretending all is well and the message has been posted seems your best approach (if you are sure about the spam). Of course the bot could come back later and look for it's own message to try something slightly different if it's not there. But then you would block the IP address because you know who it is. Anyway, anything but success as a response will give away you spam detection immediately. Sep 17 at 5:21
  • 1
    There is no "best convention" for this. This depends a lot on how many users your site has, how much spam you get, what happens to the posts (are they visible immediately all over the world, or are posts moderated?), can everyone post or only registered users, can posts be marked as spam by other users like here in the SE network, and so on. When you ask such a question, please try to give more context.
    – Doc Brown
    Sep 17 at 7:08

1 Answer 1


I think there is a pretty standard practice for this

  1. Add a CAPATCHA
  2. If CAPATCH is passed but spam is detected, move to a review queue instead of publishing
  3. User can see their own review posts as if they were published but others can't
  4. Optionally have a human process the review queue.

Not the answer you're looking for? Browse other questions tagged or ask your own question.