FrontPage Guestbook, Board, Forms spam
Submitted by chris on April 2, 2006 - 22:54. IIS SecurityThe main raison for people spamming your FrontPage Guestbook, Forum/Board or forms is that the search engine Google, counts every "back link" (i.e. link pointing to these SPAM sites) as a positive vote. So if they can get a link to their site on your Guestbook, Google will interpret this as an "endorsement" of their site and give then additional "importance".
This spamming activity is especially common nowadays since they are thousands of automated scripts looking for FrontPage (or not, they will try to spam anything really...) guestbooks, boards, or forms to post SPAM links.
To limit the amount of SPAM your guestbook or forms receive add some "form
field" validation and allow only letters, numbers, whitespaces and a few
punctuation marks such as ',." don't allow : or /. As these spammers "get
better", improve your "form fields" validation to ban then from posting to
your guestbook or forms.
You can notify, the valid readers of your site, about these validation rules.
I'm also testing out the tip, to disable HTML Link to be hot (working) by
doing the following:
1) Change the following in your Guestbook page code:
<!--webbot bot="SaveResults" U-File="guestlog.htm" S-Format="HTML/DL"...
to
<!--webbot bot="SaveResults" u-file="guestlog.htm" s-format="HTML/PRE"...
or alternatively with:
2)
Open your guestbook page in FP (the form)
Right-click inside the form area on that page and select the menu item "Form
Properties..."
Click on the "Options..." button in the bottom-right of the window that opened
In the "File format:" drop-down list, select Formatted text within HTML.
To correct your weird looking guest use styles sheets, or directly within the
Guestbook page in the <head> section, like:
<style type="text/css">
<!--
pre { font-size: 12px; font-family: Arial,Helvetica,Verdana; }
// -->
</style>
Note that the spammers hitting directly your guestlog.htm (avoiding your form with .../_vti_bin/shtml.exe/....htm) will not be blocked by this. No simple way to really block those spam techniques. It is really a Microsoft design issue.
Note: Large guest books (and most FrontPage managed bots) can become a serious issue concerning performance, see: FrontPage Server Extensions Performance