Defeating Spam Bots

Always funny how much we can get done when there’s a looming deadline. 🤣

Got a short trip coming up (RV trip down to the Florida Keys) next week and I’ve been getting so much done! Two reminders for me are:

• If you want to get something done, reduce the amount of time you have to do it.
• Complete cycles of action and don’t leave things sitting around incomplete.

Anyway, that’s mostly non-business stuff I’m referring to. When it comes to the business and projects, there’s much to do.

I’m thinking of reorganizing how client projects are organized and scheduled. There may be a “waiting list” and a schedule here. Plus, I’m looking at hiring to increase throughput.

I’ll let you know what I come up with. 😇 This is a nice problem to have, I guess. But, in the end, I need to put my business owner hat on again here and work up some systems to deliver on client projects faster.

So, let’s get into it…

What’s coming up in this issue:

• Ways to reduce the annoyance of spam bots on your website
• WordPress Quick Bits (new Fluent updates)
• Why your WordPress emails might have crappy deliverability

Let’s go…

Defeating Spam Bots

One of the facts of life with having a website is that you have to deal with spam bots. These bots will do things like:

• Post spammy blog comments
• Create spammy user profiles through user registrations
• Fill out contact forms with spammy/promotional messages

It can be a real nuisance. Like a fly that won’t stop buzzing in your ear… or mosquitos that won’t stop biting you.

When I say it is a fact of life, what I mean is that I’ve found it is pretty much impossible to remove all spam bots. You won’t achieve perfection on this. That said, there’s still quite a lot you can do so at least you don’t leave the doors wide open.

Let’s go over some of the things you can do to defeat the spam bots.

• Either run a spam-blocking plugin like Akismet for comments… or turn off comments altogether. Most sites I work with don’t really have a lot of need for blog comments, and disabling them just ends up alleviating a lot of headache.
• If you must have blog comments turned on, turn off the website URL field. A lot of these bots are hunting for backlinks. Just remove the field. It is useless. PerfMatters can do this for ya.
• In WordPress settings, be sure to disable new user registrations. If you need free user registrations for a membership site, run it through a robust forms plugin with proper spam protections. Don’t use the built-in WordPress registration.
• Rename your WordPress login. Instead of the default wp-login.php, rename it to something else. WPS Hide Login can do this. I often use PerfMatters. Lots of ways to do it, but making your site different than most others helps throw bots off the scent from trying to log into your site.
• If using WooCommerce, be sure to turn OFF the option for people to create a new account from the “My Account” screen. That’s just another avenue for spam user registrations without much control.
• Use a firewall. For my Concierge clients, I provide a firewall powered by Malcare.
• Run your domain DNS through Cloudflare as they provide some bot protection and keep some of it from ever arriving at your server to begin with.
• On your contact forms, some forms plugins are bigger spam magnets than others. Contact Form 7 and Elementor forms I’ve seen can be problematic, for instance. I’ve had good luck with Fluent Forms.
• Always use at least a spam honeypot on your forms. It should be in your forms settings. For better protection, use something like Recaptcha or something similar. I always try a plugin change and honeypot before using Recaptcha, since Recaptcha can be annoying.
• If you’re having bots fill out opt-in forms and end up on your list, make sure you have the proper form protections. Additionally, consider using double confirmation on your incoming emails or at least having a solid engagement sequence and auto-purging the invalids and subscribers that don’t respond.

If you need any help with any of this, don’t hesitate to reach out. And some of the tools and techniques mentioned here are things I do for Concierge clients all the time.

Like I said, though, it is really tough to achieve perfection on this stuff. In the end, if you have a site which is known and has much longevity to it, bots are just something you’re going to have to deal with in some capacity. Even hardened contact forms will sometimes get spam. It is tough to completely shut it off.

This Week In Concierge

Last week, one of the interesting things was that a client booked 3 credits with me and then a call. The purpose of that call was to re-build 2 of his websites using Kadence Theme and do it right in front of him. That way he can learn how Kadence works while we do it.

He actually sent over the logins to 3 sites. If we had the time, we’d bang all 3 out.

And, we did. It was a marathon call that took almost the full 3 hours. And I fully re-built 3 of his websites. 2 were on Thrive Themes and 1 was using Beaver Builder.

Now, these 3 sites weren’t exactly huge. Essentially, each of them were small business brochure-style sites with a few pages each. And now all 3 of them are running on Kadence. He didn’t even need the Pro version. Free version all the way was more than enough.

One confusion I see a lot with people who are using Thrive Themes is that they built so many of their pages as landing pages. When you build a landing page with Thrive Architect, you’re actually bypassing the theme altogether. Even if Thrive Theme Builder is in there, you’re not even using it.

The funny thing about a site built this way is that I can drop a new theme in there (Iike Kadence) and nothing really changes…. and that’s because each “landing page” is a standalone thing built with Architect.

So, we end up having to manually re-build each page of the site as a duplicate. Then, rename pages to substitute the old version with the new one.

Anyway, always a good time when I can help clean up bloated websites using Thrive Themes. This client was having his annual bill doubled (which is what Awesome Motive is doing to Thrive subscribers) and my client decided to move on. Smart move.

WordPress Quick Bits

FluentBooking 1.4.1 Released. A performance release for FluentBooking has been launched, offering better management for cancellations and rescheduling and some other performance tweaks. This plugin has really matured well and I expect great things to come, too. Check out the announcement.

Fluent Support Gets Some Love. Version 1.7.9 has been released, offering seamless integration with Fluent Boards (launching this week), uploads to Google Drive, cloning workflows and more. Announcement here.

FluentCRM 2.9 Released. This new release offers new bulk actions for contacts, dynamic smart coupons with WooCommerce, centralized view of automation activity, and more. That coupon thing is actually quite cool. It’ll allow you to create dynamic coupon codes (a unique code per contact) within an automation to enable individual discounts. Really cool. Here’s the announcement.

WordPress Turns 21.. I guess WordPress is now old enough to get drunk. 🥴 It has officially turned 21 years old. Matt Mullenweg (original founder of the WordPress project) shared a quick post about it with some opinions on where things stand.

Siren Affiliates Near Launch. A new affiliate plugin called Siren Affiliates is gearing up for it’s official launch and will get a limited-time lifetime option. Will be interesting to watch this one.

Cloudways Offers Malware Protection Addon. Cloudways has partnered with Imunify360 to offer enterprise-level security and malware protection as a paid add-on for $4/mo per app. Check out the announcement here. Actually, that isn’t a bad deal.

Why You NEED An SMTP Email Service For Your Website

As you likely know, WordPress generates emails. Those emails could be notifications from your contact form, comment notifications, password reminders, receipts from WooCommerce, etc.

And even if you’re using a third-party email list host like ConvertKit or similar, those types of emails mentioned above are still sent from WordPress itself. If you also host your email list in-house (using something like FluentCRM), then the issue gets even more pronounced.

That issue is…. that most web hosts truly SUCK when it comes to email deliverability.

They’re just not set up right for it. And even though your web host might spit off the email on cue, that email has a much higher likelihood of ending up in spam boxes and never arriving. It is really just throwing poopie on the wall when you rely on your web host to send such emails for you.

But, so many people do just that. They toss their sites on something like Siteground, WPEngine, Rocket… or even worse… Godaddy, Bluehost, Hostgator, etc. And it never dawns on anybody to think about email deliverability of those emails generated by WordPress itself.

It is highly recommended that you use a dedicated email SMTP service and connect your site to it.

SMTP is just the email protocol used to send email. And an SMTP service is just a service dedicated to send bulk emails.

You use a web host to host your site. You don’t use a web host to send bulk emails. You use a proper service for that.

There are a lot of them out there. Sendgrid, Amazon SES, Mailgun, ElasticEmail, Postmark, etc. Take your pick.

Personally, I really like PostMark. It is what I use for transactional emails and it is a service I provide for my Concierge clients so that their WordPress emails have solid deliverability.

I also recommend you use FluentSMTP as your plugin to connect your site to an SMTP service of your choice. A lot of people end up using WP Mail SMTP for this because it has good rankings and Awesome Motive plugins end up pushing this thing hard. But, I don’t recommend it. It is just bloatware that tries to sell you the “Pro” version for stuff that FluentSMTP already does for free. Just use FluentSMTP. Trust me. 😇