DokuWiki Spam Protection — Blacklists, CAPTCHA, Anti-Spam Plugins, and IP Blocks

In this tutorial, you'll learn how to protect your DokuWiki from spam and automated abuse using blacklists, CAPTCHA, anti-spam plugins, IP blocking, and preventive configuration.

What You'll Learn

• How spam affects DokuWiki wikis
• Built-in spam blacklist
• CAPTCHA integration
• Anti-spam plugins
• IP blocking and Rate Limiting
• Preventing spam accounts
• Configuring email notifications for edits

Why It Matters

DokuWiki's open editing model makes it vulnerable to spam. If your wiki allows anonymous editing or open registration, spammers will find it. A single spam bot can create hundreds of spam pages in minutes, polluting your wiki's content, search results, and database. Proactive spam protection is essential for any wiki that allows public contributions.

Real-World Use

A community documentation wiki allows anyone to edit pages. The admin installs the CAPTCHA plugin and configures the spam blacklist. When a spam bot attempts to create pages advertising pharmaceuticals, the blacklist blocks the content. The CAPTCHA prevents automated signups. The wiki remains clean with minimal admin overhead.

Learning Path

flowchart LR
  A[Authentication] --> B[Spam Protection]
  B --> C[Plugin System]
  C --> D[Essential Plugins]
  D --> E[Custom Plugins]
  E --> F[Plugin Security]

Built-In Spam Blacklist

DokuWiki includes a built-in spam blacklist at conf/blacklist.txt. This file contains patterns that are checked against page content when saving.

Default Blacklist

The default blacklist includes common spam terms:

# conf/blacklist.txt
# This file contains regular expressions that block page saves
# when the content matches.

buy\ now
click\ here
free\ money
viagra
casino

Adding Custom Patterns

Add your own patterns to the blacklist:

# Custom patterns for our wiki
cryptocurrency
get\ rich
work\ from\ home\ \d+

Patterns are regular expressions. Each line is checked against the page content. If a match is found, the save is blocked.

Disabling the Blacklist

<?php
// conf/local.php
$conf['useblacklist'] = 0;  // Disable blacklist checking (not recommended)

CAPTCHA Integration

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) prevents automated submissions.

Installing the CAPTCHA Plugin

cd /var/www/html/wiki/lib/plugins/
wget https://github.com/splitbrain/dokuwiki-plugin-captcha/archive/master.zip
unzip master.zip
mv dokuwiki-plugin-captcha-master captcha

Configuration

<?php
// conf/local.php
$conf['plugin']['captcha']['mode'] = 'image';    // Image, audio, or math
$conf['plugin']['captcha']['width'] = 180;        // Image width
$conf['plugin']['captcha']['height'] = 60;         // Image height
$conf['plugin']['captcha']['size'] = 20;           // Font size
$conf['plugin']['captcha']['maximumMistakes'] = 3; // Allowed retries

Where CAPTCHA Appears

By default, CAPTCHA appears on:

• User registration form
• Page edit form (if anonymous editing is allowed)
• Media upload form

You can configure which forms require CAPTCHA:

<?php
$conf['plugin']['captcha']['login'] = 0;      // No CAPTCHA on login
$conf['plugin']['captcha']['register'] = 1;   // CAPTCHA on registration
$conf['plugin']['captcha']['edit'] = 1;       // CAPTCHA on page edit
$conf['plugin']['captcha']['upload'] = 1;     // CAPTCHA on file upload

reCAPTCHA Plugin

Google's reCAPTCHA is more user-friendly than image-based CAPTCHA.

# Install the reCAPTCHA plugin
cd /var/www/html/wiki/lib/plugins/
wget https://github.com/username/dokuwiki-plugin-recaptcha/archive/master.zip
unzip master.zip
mv dokuwiki-plugin-recaptcha-master recaptcha

Configuration:

<?php
// conf/local.php
$conf['plugin']['recaptcha']['sitekey'] = 'your-site-key';
$conf['plugin']['recaptcha']['secretkey'] = 'your-secret-key';
$conf['plugin']['recaptcha']['theme'] = 'light';        // light or dark
$conf['plugin']['recaptcha']['verify_ssl'] = 1;          // Verify SSL certificate

Get your site key and secret key from https://www.google.com/recaptcha/admin.

Anti-Spam Plugins

Additional plugins for spam protection:

Deny Plugin

Blocks specific users or IP addresses from editing:

cd /var/www/html/wiki/lib/plugins/
wget https://github.com/username/dokuwiki-plugin-deny/archive/master.zip
unzip master.zip
mv dokuwiki-plugin-deny-master deny

Approve Plugin

Requires admin approval for new pages created by new users:

cd /var/www/html/wiki/lib/plugins/
wget https://github.com/username/dokuwiki-plugin-approve/archive/master.zip
unzip master.zip
mv dokuwiki-plugin-approve-master approve

Loginkin Plugin

Requires login to view or edit pages. This is the most effective anti-spam measure — if users cannot access the wiki without logging in, spammers cannot target it.

IP Blocking

Preventing Spam Bots

Use .htaccess to block known spam IP ranges:

# .htaccess in DokuWiki root
Order Allow,Deny
Allow from all
Deny from 123.45.67.0/24
Deny from 98.76.0.0/16

Blocking by Country

Use the GeoIP module in Apache or Nginx to block traffic from countries that generate spam.

Rate Limiting

Use Nginx or Apache modules to limit requests per IP:

# Nginx rate limiting
limit_req_zone $binary_remote_addr zone=wiki:10m rate=5r/s;

server {
    location / {
        limit_req zone=wiki burst=10 nodelay;
    }
}

Preventive Configuration

Disable Anonymous Editing

The most effective spam prevention:

<?php
// conf/local.php
$conf['useacl'] = 1;           // Enable ACL
$conf['openregister'] = 0;     // Disable self-registration

With ACL enabled and registration disabled, only manually created accounts can edit.

Registration Approval

If you need open registration, enable admin approval:

<?php
// Disable automatic account activation
$conf['autopasswd'] = 0;       // Admin must approve accounts

Email Verification for Edits

Enable email notification for edits:

<?php
// conf/local.php
$conf['notify'] = 'admin@example.com';        // Notify on all edits
$conf['registernotify'] = 'admin@example.com'; // Notify on new registrations

Handling Spam When It Happens

Reverting Spam Edits

1. Go to the page history
2. Identify the spam revision
3. Revert to the previous clean version

Bulk Spam Cleanup

For large spam attacks:

# Delete all pages created by a spammer
# First, find pages by the spammer username
grep -l "spammer" data/pages/*.txt

# Then revert or delete them
php bin/cleanup.php --purge

IP-Based Blocking After Attack

Check server access logs to identify spammer IPs:

# Find IPs that created multiple pages quickly
grep "edit" /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -n

Then block the identified IPs in .htaccess or firewall.

Common Mistakes

1. Relying only on blacklists: Blacklists block known spam patterns but do not prevent new spam variants. Combine blacklists with CAPTCHA and ACL.
2. Enabling CAPTCHA on login forms: This frustrates legitimate users and provides minimal anti-spam benefit. Spammers target edit and registration forms, not login.
3. Not monitoring for spam: Spam can exist for weeks before discovery. Set up email notifications for all edits.
4. Blocking entire IP ranges without checking: Some IP ranges belong to legitimate services (Google, AWS). Check before blocking.
5. Forgetting to update the blacklist: New spam patterns emerge constantly. Update conf/blacklist.txt regularly with patterns you observe.

Practice Questions

1. What is the built-in DokuWiki spam blacklist, and how does it prevent spam page creation?
2. How does the CAPTCHA plugin differ from the reCAPTCHA plugin, and when would you use each?
3. What is the most effective anti-spam measure for DokuWiki, and why?
4. Challenge: Design a complete anti-spam Strategy for a public wiki that allows anonymous editing. The strategy should include: at least three layers of protection (preventive, automated, and reactive), specific plugins and configurations, a response plan for when spam occurs, and a monitoring plan. Implement your strategy on a test wiki and simulate a spam attack (using safe test content) to verify each layer works.

FAQ

Mini Project

Goal: Implement a multi-layer spam protection system.

1. Configure the built-in spam blacklist with at least 10 custom patterns
2. Install and configure the CAPTCHA plugin on the registration form
3. Disable anonymous editing if it is enabled
4. Set up email notifications for all edits
5. Configure IP rate limiting in Nginx or Apache
6. Test each protection layer:
   • Try to save a page with blacklisted content (should be blocked)
   • Try to register without completing CAPTCHA (should be blocked)
   • Verify email notification is sent when a legitimate edit is made
7. Create a documented spam response procedure

What's Next

Spam protection keeps your wiki clean. Now dive into the plugin system to extend DokuWiki's functionality.