Although vandalism and spam are constant aggravations, the ongoing efforts of thousands of editors—like you—do a surprisingly good job of minimizing these problems. This chapter explains in detail what you, a Wikipedia editor, can do in terms of spotting and fixing vandalism and spam.

For Wikipedia, the "encyclopedia that anyone can edit," vandalism—the destruction of content or the addition of useless or malicious content—is a constant, ongoing issue. "Anyone" includes cranks, juveniles (of any age) who don't have anything better to do, and those who hold a grudge against Wikipedia because of past blocks or bans. For readers, obvious vandalism casts doubt on the accuracy of Wikipedia articles. If the vandalism is subtle, readers can be deliberately misinformed. For editors, fighting vandalism reduces the amount of time available to improve articles.

Spam, at Wikipedia, refers to improper external links added to Wikipedia articles, which is why you often see the term linkspam. Spam is a smaller problem than vandalism because most readers of Wikipedia articles don't follow external links. Still, as Wikipedia becomes more widely read, the temptation grows to add links in the hopes that someone will click them, generating traffic for the spamming Web site. (See the box below for more detail on the differences between vandalism and spam.)

Fighting vandalism and spam is a bit like doing detective work: In addition to figuring out who did what (Chapter 5: Who did what: Page histories and reverting), you investigate the extent of the problem, assess the possible underlying motives of the perpetrator (that affects things like warning levels), and then decide what to do (warn, request a block, and so on). It's important work, and many editors specialize in it.

The Wikipedia community has evolved multiple lines of defense against vandalism and, to some extent, spam. They are, roughly in the order of how fast they kick in (bots being the fastest):

• Bots. Much vandalism follows simple patterns that computer programs can recognize. Wikipedia allows bots to revert vandalism: in the cases where they make a mistake, the mistake is easy to revert.
• Recent changes patrol. The RCP is a semi-organized group of editors who monitor changes to all the articles in Wikipedia, as the changes happen, to spot and revert vandalism immediately. Most RC patrollers use tools to handle the routine steps in vandal fighting.
• Watchlists. Although the primary focus of monitoring is often content (and thus potential content disputes, as described in Chapter 10: Resolving content disputes), watchlists are an excellent way for concerned editors to spot vandalism. (Watchlists and other methods of monitoring articles are described in Chapter 6: Monitoring changes.)
• Readers. Readers, including editors who are just looking over an article, are in some sense the last line of defense. Most readers don't know the proper way to remove vandalism (but you do, if you've read Chapter 6: Monitoring changes). Still, even if readers bungle vandalism removal, they've still improved the page, and hopefully a more experienced editor will complete the job.

When you read a randomly picked Wikipedia article, you rarely see vandalism. That's a testimony to the effectiveness of vandal-fighting, despite evidence that the extent of vandalism is increasing (Figure 7-1).

If you simply revert a vandalizing or spamming edit, and then go about other business, you've missed a major opportunity to find other vandalism and spam by the same editor. Worse, you've made it less likely that other editors will check the edit history of that editor in the future, looking for vandalizing and spam, and if indeed there are such problems, you've given the problem editor more time to continue with destructive editing.

To handle vandalism and spam the way experienced editors do, you should do three things in addition to reverting the problem edit: determine if that editor has other problem edits, and deal with those as well; post an appropriate warning to the editor; and, in extreme cases, ask an administrator to block the problem editor. Experienced editors also know how to ask that a page be protected if it's repeatedly vandalized by a number of different (typically, anonymous IP) editors.

This chapter shows you the right way to approach what looks like vandalism. For the mechanics of identifying and reverting a problem edit, flip back to Chapter 5: Who did what: Page histories and reverting.

Most vandalism is obvious. But when you encounter something you're not sure about, Wikipedia's guidelines suggest that you assume good faith in assessing the edits of others. (Details at WP:AGF.) That doesn't mean that you should excuse vandalism and spam; it means that when you encounter something that's in a gray area, investigate further, as described in this section. If it isn't clearly vandalism or spam, fix the erroneous edit, and presume it was a mistake.

As a general rule, fix improper edits and remove irrelevant links, but if the editor in question has a history of constructive edits, don't label those edits as vandalism, and don't call the links linkspam unless you find a lot of problem edits. New editors can make honest mistakes.

Consider the edit summary

Some vandals are clever enough to add a semi-plausible edit summary to a vandalizing edit. Still, if there's an edit summary, you should consider that major evidence that you're not looking at vandalism, but rather at a content dispute (Chapter 10: Resolving content disputes). On the other hand, if you're looking at a questionable edit which also lacks an edit summary, it's appropriate to lean toward treating it as vandalism.

Note that some edit summaries are automatically added by the software, such as the title of the section edited (see the section about reading a page history). The software can also add other summaries if an editor does not enter any edit summary. Many of these automatic summaries highlight obvious vandalism, such as "Blanked the page". Such automatic summaries are prefixed with a left-pointing arrow (←). For judging whether something is vandalism, treat automatic edit summaries as if no edit summary was there, since they indicate that none was entered by the editor.

Consider the source

Before you revert an edit, you should always think about who did that edit. Take the editor's history into account when you're estimating the likelihood that an edit is vandalism. Here are the two extremes:

• Anonymous IP edit; link to user talk page is red. The red link means that no one has ever posted to the editor's user talk page, which in turn indicates that there have been few or no other edits by this IP address, which means few or no constructive edits. In this case, you don't need to do any further research before reverting. If you see a questionable edit from this kind of user account, you can be virtually certain it was vandalism.
• Experienced editor. When you follow the link to the editor's User contributions page, you see a lot of edits with edit summaries. When you click the "oldest" link, you find that the editor has been around for years. When you check the editor's block log, you don't find anything (or anything within the past 12 months). (A user block log shows whether the user account has been blocked for vandalism or other problems. You can see the "Block log" link at the top of the User contributions page; see Figure 7-2.)

In the rare case that you think there's a problem with an edit from this kind of editor, chances are you've misunderstood something. You may have clicked on the wrong line in the history page (an edit you don't want to revert), or you may be looking (again, by mistake) at an edit that fixed vandalism rather than created it.

The less clearly an edit is vandalism, the more you should consider the source

Suppose you notice an edit where a date has been changed – say, from "1920" to "1921," or the middle name of a person has been changed from "Smith" to "Smithers." Is it vandalism or not? When you check the page history, you see this isn't just a revert to the way the article had been earlier—it's a new change. You need more information.

Ideally, the article would have a citation that included an external link, so that you yourself can verify the information in the article. But if no external link provides an answer, even in the "External links" section, then information about the editor can help you decide what to do. Start by looking at the link to the user talk page. If it's a red link, there's no user talk page, so the user account is almost certainly new. You should then basically revert on principle, because it's more likely that the original information was correct than the change made by an editor who's apparently brand-new to Wikipedia. If the link to the user talk page is blue, follow it. If there are warnings, then again it's likely that the edit you're examining is vandalism.

If the editor in question is registered, not an anonymous IP editor, and there's no evidence that the editor is a vandal, then it's a courtesy to drop a note on the editor's user talk page, saying you've reverted the edit due to lack of an edit summary and lack of a citation, and that the editor should feel free to make the change again if an explanation is provided. Notes like that help inform new, well-intentioned editors about the right way to do things.

If the questionable edit you're examining was done by adding text to an article, not by deletion or changing of information, consider alternatives. You can, for example, add the Citation needed template (type ((citation needed|date=February 2024))) to the end of a sentence or paragraph that you question, rather than deleting it. You can also edit it a bit to make the language more neutral.

Explain your edit

When you revert vandalism and spam, it's critical to leave a clear edit summary. If you're dealing with obvious vandalism by a user account with no apparent history of constructive edits, then rv will suffice. That abbreviation tells experienced editors that you've reverted vandalism; it's fine that it's cryptic because communication with the editor who did the obvious vandalism is unlikely. With less clear cases, your edit summary needs to be lengthier because it may be the start of a dialog with another editor.

For example, if you suspect a subtle form of vandalism like changing a date or name but can't prove it, something like rv edit unsupported by a citation; edit made by a user without history of constructive edits is appropriate. Think of your edit summary as a sort of log entry; even if you're incorrect, you've still started a constructive dialog by explaining yourself.

If another editor has deleted a bunch of text but doesn't offer any explanation in the edit summary, a good edit summary for your reversion would be rv unexplained deletion. This summary explains why you restored the text and invites that editor to add an edit summary next time.

Looking for more vandalism and spam

Some vandals hit only one page; some hit many. Spammers typically hit many pages, but sometimes only one (or they're caught early in a spamming spree). A good editor, upon finding one problem edit, looks for others. The place to do so is the editor's User contributions page. After you've identified the problematic edit, and are looking at a history page, you can jump to the contributions page of the problem editor in one of two ways:

• For anonymous IP editors, click the IP address.
• For registered editors, clicking the "contribs" link.

At the User contributions page, focus primarily on edits done in the past couple of days. But your first concern should be those edits which have a "top" in bold at the end of the row (see Figure 7-3). If an edit was vandalism or spam, and it has a "top" at the end, that means it has not been reverted.

How you go about reviewing a specific editor's edits is a matter of personal style. Here are some tips:

• Start with "top" edits, as shown in Figure 7-3, since they clearly haven't been reverted. If they're a problem, fix them immediately, if possible. And look at all the other edits the editor did to the same page—they won't be "top" edits, but they also may be unreverted.
• Just because an edit isn't a "top" edit doesn't mean it's been fixed. It means only that the page has been subsequently edited, perhaps by someone else who completely missed vandalism or spam. Or a bot could have stopped by to fix a category or do other maintenance work, oblivious to any other problems.
• A registered editor who has vandalized or spammed an article represents a significant problem. Registered editors can do much more than anonymous IP addresses (creating pages, moving pages, and so on). Vandalism-only registered accounts in particular need to be dealt with promptly.

If you find a registered editor who has done more than a couple of edits, all these edits are vandalizing, and the most recent edit is in the last 24 hours or so, then don't bother posting a warning. Instead, ask an administrator to block the account (see the section about reporting vandalism). (If the administrator reviewing the case decides not to block, they'll post a warning as an alternative.)

• Multiple people can be using the same IP address: a library or school computer; a dial-in IP address that's constantly reassigned; an Internet service provider who uses a proxy address for multiple customers; and so on. In these cases, older edits may have been done by a completely different person, so don't use them in analyzing what an IP user account did in the recent past.
• For linkspam, if the editor is posting the same link to multiple articles, you can query Wikipedia to see how many of the links still exist (that is, no one else has deleted them yet). To do so, go to the Special:LinkSearch page, and put in the URL (see Figure 7-4 for an example).

• If you find a lot of unreverted vandalism and don't have time to deal with it, post a note at Wikipedia:Help desk (shortcut: WP:HD) so other editors can help out. For spam, post (in a new section) on the talk page of Wikipedia:WikiProject Spam (shortcut: WP:WPSPAM). (For detailed information about posting comments to talk and other discussion pages, see Chapter 8: Communicating with your fellow editors.)

Don't feel your reporting a problem is just shifting the workload to other editors. Wikipedia has power tools—including some available only to administrators—that can do mass reverts, which sharply reduces the amount of work in dealing with a problem editor. So when you post at one of these two pages, you're helping make sure that problem edits get fixed quickly. That's particularly true for the spamming of a large number of pages—if you don't have a lot of experience with reverting, it's really not worth your time to manually remove spam links from lots of pages, since some editors specialize in this.

• Vandals often edit the same page multiple times, so make sure you get them all. Often other editors have fixed most of the vandalizing edits, so do a diff (see the section about diffs) that includes the vandalism and its repairs (a diff on multiple edits) to make sure that the net impact of fixing vandalism was to bring the article back to its state before the vandalism. (It can be reassuring to know that others have been dealing with this problem editor.)
• When you're investigating an editor, it's normal to focus, at the User contributions page, only on edits in the past couple of days (or, if there are few edits, to look at the last dozen or so, perhaps even fewer). Reviewing older edits has much less payback; should you find one that wasn't fixed, it presumably was to a page that gets few readers, so it didn't have a great impact anyway. Plus, the older an edit, the more likely that there have been a number of subsequent edits, making it more difficult to figure out whether the vandalism got fixed (properly) or not. However, if you're checking for vandalism by a registered editor, you should review every page where that editor has a "top" edit, no matter how old that "top" edit is.

So, you've found some vandalism or spam, and researched other edits by the same user account to see if there's more. The next, and important, step is to post an appropriate warning on the editor's user talk page.

The primary purpose of a warning about vandalism or spam, perhaps counter-intuitively, is not to get the problem editor to change their ways. (It would be nice if they did so, but troublemakers aren't like to reform themselves just because someone asked nicely.) Rather, when you and other editors post a series of increasingly strong warnings, you're building a documented case for blocking a user account from further disruptive editing. If the warnings lead to the editor changing their ways before blocking is necessary, great—but don't hold your breath.

Choosing the warning and warning level

Start by looking at the warnings that have already been posted on the user talk page, if any. Then take a look at the history tab for the user talk page: the editor might have deleted warnings by other editors.

You'll find a table of warnings at Wikipedia:Template index/User talk namespace (shortcut: WP:WARN). Warnings to editors come in levels 1 through 4:

• Level 1. Assumes good faith. Generally includes Welcome to Wikipedia or some variant.
• Level 2. No faith assumption.
• Level 3. Assumes bad faith; cease and desist.
• Level 4. Assumes bad faith; strong cease and desist, last warning (this level of warning must be preceded by at least one prior warning).
• Level 4im. Assumes bad faith; strong cease and desist, first and only warning.

From the warning table, pick an appropriate warning at the level you've chosen. Picking the appropriate level of warning is an art, not a science. Here are some general guidelines:

• You don't have to start at level 1, nor do you have to escalate if the editor seems to have generally behaved after getting a prior warning, but you should always post some level of warning, or a note, when you find a recent problem.
• If you're not sure about what level of warning to post, pick one, post it (as described in the next section), and do a page preview. If the wording doesn't seem to fit, go up or down a level and see what that looks like.

For example, assume that you found vandalism, and that a level 2 warning had already been posted for that same type of vandalism. You should post a level 3, or, if you just found a lot, perhaps even a level 4 warning.

• If there already was a level 4 (final warning), you can normally skip directly to the next step—asking an administrator to block the user account (see the section about reporting vandalism).

Exception: If the most recent vandalism or spam by a user account is older than 48 hours, administrators don't usually put a block in place. Blocks are preventive, not punitive (see the section about blocking vandals). So if you find old vandalism and a prior level 4 warning, it may be helpful to post another "final warning" as a note to other editors not to give this user account any leeway in the future.

Posting the warning

Once you've selected an appropriate warning template, posting it is a quick five-step process. (If you're not dealing with a real situation, you can still practice this procedure by posting to your own user talk page. Just don't click "Publish changes". Instead, in the last step, stop after doing the preview.)

1. On Wikipedia:Template index/User talk namespace (shortcut: WP:WARN), copy the text of the template warning to the clipboard (Ctrl+C on Windows; ⌘-C on Mac).

This step is optional, but may save you time later. Or you may want to use the clipboard for something else, like the name of the page where the problem edit occurred.

2. On the user talk page where you want to post the warning, click the "+" tab at the top to start a new topic.

3. You're in edit mode, with a new section visible for you to edit.

4. In the subject line, type Warning or something more specific like Warning – your edit to [[Name of article]].

It's important to use neutral language here. Your primary goal is to provide information to other editors, not to chastise someone you think is a vandal. If you get personal (expressing emotion, and/or commenting on the editor as a person), you run a serious risk of either biting a newcomer (see WP:BITE for details) or feeding a troll (see WP:DENY and WP:DIV for details).

5. In the body of the new topic posting, paste (or type) the template, with ((subst: at the front and )) at the end, followed by tildes for your signature (for more on signing your comments, see the section about signing comments).

For example: ((subst:uw-vandalism3|Article)) ~~~~

6. Click "Show preview" to make sure everything worked as expected (see Figure 7-5).

7. If everything looks okay, then click "Publish changes".

If you are warning a user identified by an IP address, it may also be worthwhile to perform a WHOIS lookup on the address (The WMF has a tool to carry this out). Use the results from this to place a suitable WHOIS template, from the table on this page, on the users talk page. In some circumstances a user realising their ISP, business, or school can be traced, may lead to a cessation of the vandalism.

When not to post a warning

It's generally not worth posting a warning in these cases:

• If you find older vandalism, and the editor's already been warned. Adding a warning is appropriate only when a new type of problem arises, or when someone has ignored a prior warning and continued some improper behavior.
• If the user received a level 4/4im, last/final warning, and vandalized after that. Just request the user be blocked, as described in the section about reporting vandalism below.
• If an anonymous IP address vandalized only a single page, on a single occasion (including consecutive edits), and has never done any other editing. Here you're dealing with a hit-and-run vandal. It's highly unlikely the vandal will reappear with that IP address, so nobody's going to read any warning you post, and there's no point in laying down an initial warning for other editors to build on.

Wikipedia has a well-known saying: "Don't template the regulars." As discussed above (see the section about considering the source), someone who has a long history of constructive edits isn't likely to have done a vandalizing or spamming edit. If it looks like they did, you should double-check and triple-check before proceeding. And if you do conclude that their edit looks non-constructive and revert it, don't use a warning template to post a message: Write something more personal. (For example, you might post something like I'm not sure I understood ((diff|Some page|prev|234567890|this edit that you did)), I reverted it because it looked like a mistake; please let me know if I missed something.)

In cases of vandalism and spam, administrators (there are 869 of them at the English Wikipedia) can take two types of preventive measures unavailable to normal editors—protecting pages and blocking vandals.

Protecting pages

If a page is repeatedly vandalized by a changing cast of anonymous IP editors, then temporary semi-protection of the page is probably appropriate. Semi-protection means that registered editors can still edit the page (starting 4 days after they register), but anonymous IP addresses can't. (Anonymous users with suggestions for changes should post them to the article talk page.) It's quite unusual to fully protect a page because of vandalism; full protection is normally done only for cases of major content disputes (see Chapter 10: Resolving content disputes).

In the first sentence of the prior paragraph, two key words are "repeatedly" and "changing." You shouldn't request semi-protection of a page unless there have been at least a half-dozen vandalizing IP edits in the last 24 hours or so. If there are fewer, administrators may feel that it's better to simply manually revert the vandalism. And the IP addresses need to vary or otherwise be unblockable. Otherwise, administrators prefer blocking a few IP addresses.

To request semi-protection, post at Wikipedia:Requests for page protection (shortcut: WP:RFPP).

Note that semi-protection is normally only temporary: The goal is to get vandals to lose interest in the protected page. Anonymous contributions have built a significant percentage of Wikipedia, so the Wikipedia community is very reluctant to close off editing to all IP addresses for an indefinite period, even to only a single page.

General guidance on blocking vandals

Blocking is a preventive action, not a punitive one. If, for example, you find vandalism that's more than a day or two old (different administrators have different thresholds), it's pretty unlikely that your request to block the account will be granted.

An administrator can block an account for any amount of time between a minute and indefinitely. Registered accounts whose only edits have been vandalism are typically blocked indefinitely, but other user accounts usually get an escalating approach. For example, block for a day; if vandalism recurs, block for a week; if it recurs again, block for a month; and only then, if it recurs again, block indefinitely.

Reporting vandalism

In this tutorial, you'll report a fictional vandal, an anonymous user who edited from IP address 127.0.0.1, and who vandalized six articles about an hour ago. You'll go through all the steps of making the report, except that on the final step, after you do a preview, you'll just close the page rather than saving your edit. (Since it's a fictional vandal, you don't want to make a real report.)

Report vandalism only when you think the problem has risen to the level where warnings are no longer appropriate. Generally, that means that either the user has already received a level 4 warning, and continued to vandalize, or that this is a vandal-only registered account, or that the account gives indication of a sophistication of edits well beyond a typical new editor. (Remember: If you decide to post a warning, do not also report the vandalism to administrators for their review.) In this example, IP address 127.0.0.1 has already been blocked, 2 days ago, for 24 hours, for vandalism.

1. Go to Wikipedia:Administrator intervention against vandalism (shortcut: WP:AIV).

The top of this page is shown in Figure 7-6. It starts out with guidelines on when to report vandalism, much like you're already read in this chapter.

2. Scroll down to the section titled "User-reported", and click the "Edit" link on the left of that section title to open the section for editing.

You'll see something like Figure 7-7. Three lines begin with an asterisk. You want to copy one of these three lines to use as the base information for your posting, which you'll do in the next step.

3. In this case, since this is an IP vandal, copy the first of the asterisked rows to the bottom of the section, and then change the characters IP to 127.0.0.1.

Your screen should now look something like Figure 7-8.

4. Replace the words provide a reason (keep it short) with user was blocked for vandalism two days ago; has done it again, and then add the edit summary Reporting 127.0.0.1. Click "Show preview".

Your screen should now look like Figure 7-9 In this example, you didn't give details about the vandalizing edits—not the number of edits, or the names of the vandalized pages, or edit diffs. Administrators checking your report will review the User contributions page and the user block log, and that should suffice. (If the editor had been repeatedly warned, but never blocked, you'd say something about the warnings.)

Your goal should be to make as convincing a case as you can in 20 words or less, remembering that the administrators who handle these cases look at hundreds every day, and don't rely particularly heavily on the reports for anything but an initial starting point.

5. Close the preview window without saving, so you don't send the administrators off on a wild goose chase.

That way, you avoid getting a polite notice on your user talk page asking you to stop submitting bogus vandalism reports.

If you remove what you consider vandalism, and the same editor puts it back, don't automatically remove it again. Before reverting, you need to decide if this is a content dispute (Chapter 10: Resolving content disputes) or just a persistent vandal. Here are the factors you should consider:

• Is it clearly a case of vandalism? If, for example, the edit again replaced good content with a string of gibberish, then you don't need to consider other factors—it's vandalism. On the other hand, if the editor simply re-deleted a paragraph, perhaps it wasn't.
• Did the editor post anything about this matter on the article's talk page? If so, except for cases of extremely obvious vandalism, treat the matter as a content dispute.
• Did the other editor provide an edit summary when they reverted your edit, explaining their edit? If so, you should treat the matter as a content dispute, not a matter of vandalism, assuming that all the other factors don't point to vandalism. But if the editor failed to provide an edit summary (other than what Wikipedia added, such as section title), lean in the direction of repeated vandalism.
• What's the editor's history – other vandalism or constructive edits? As discussed in this chapter, the editor's user talk page (including its history), block log, and User contributions page provide you with a wealth of information about the editor. If they indicate that the user has at least some positive contributions and hasn't been recently blocked, treat the matter as a content dispute.

What if you revert an edit the second time, and the same editor (or another IP address that it appears the same editor has migrated to—say, an IP address that previously had no edits whatsoever) does the edit (or a very similar one) for a third time? Then you want to read Wikipedia:Three-revert rule (shortcut: WP:3RR) very carefully. If you're absolutely sure that any reasonable editor would agree that you're fighting vandalism, go ahead and revert again. But if there's any doubt at all, go to Chapter 10: Resolving content disputes.