Drupal Howto: Use Modr8 and Modr8 Bypass to protect your site from spam

The 5 or 6 regular readers of this blog may remember that a while back our Unreality Shout site was attacked by spammers and pretty heavily vandalised. I asked for suggestions for workflow solutions that would prevent a repeat of this, but without making it harder for established members to post content.

Drupal LogoSome of you Drupallers kindly sparked off some great ideas, and after flirting with the Workflow module, I decided to go with Modr8 and Modr8 Bypass. Modr8 provides the basic functionality to hold back content from being published. Modr8 Bypass then gives you the ability to choose users (based on role) who should be allowed to bypass those rules and go straight to publishing their content.

I wanted to share a tutorial for configuring Modr8 with you guys, because it took a little bit of fiddling just to get it working properly. Let’s roll up our sleeves and dive in…

1. Create a new user role and assign it to trusted members

For this to work, we need to distinguish between ordinary authenticated users and people that we trust to publish content unmoderated. I created a role called Established Member and assigned it to people on the site who were regulars and who published clean, well-written posts in the past.

2. Install the modules

I’m assuming you guys know what you’re doing – install the Modr8 and Modr8 Bypass modules in whatever manner you’re used to and then activate them.

3. Configure Content Type Workflows

OK, we’ve got a bit of tweaking to do to Content Types. What you want to do here is to remove the Published checkbox for content types you want to protect. On Shout, we protected our Blog, Wiki page and Group creation pages. New members could post unrestricted in the Forum and upload photos, but we wanted the content on those other types to be of a higher calibre.

To remove the Published checkbox, simply go to Content Types in your Drupal backend, edit the types you want. The checkbox you’re looking for can be found under Workflow Settings.

You should also tick the In Moderation Queue checkbox, which tells Modr8 to list the content for review. This is also in the workflow settings for each content type.

4. Configure Modr8 Settings

Next up, we configure the Modr8 module – go to the Modr8 page under Site Configuration. If you’ve installed both modules (basic Modr8 and Bypass), you’ll have two tabs.

The first tab deals with default moderation actions, and you can configure standard emails that’ll be sent to your users whenever you approve or reject some content. Because I’m dealing with spammers here, I opted not to send emails on deletion of content, but this whole page should be configured to your own requirements.

Modr8 Bypass has two checkboxes. Make sure they’re both ticked. They’re fairly self-explanatory – they undo the custom workflow settings we set up in step 3. This means that content is published automatically for your chosen user roles.

Or so you might think – there’s one more step to take…

5. Configure Modr8 User Permissions

This is a big gotcha – you’ve got to configure the user permissions not only to identify the roles who can bypass moderation, but also for the content types. It’s actually quite a nice, granular setting if you’ve got a bigger site with lots of content types and roles.

  1. Go to User Permissions in your Drupal admin area, and scroll to the Modr8 section.
  2. Under the Modr8 Module settings, tick “Bypass moderation queue” for your chosen roles.
  3. There’s a Modr8 Bypass section under this – check the “bypass [name of content type] moderation” under the desired roles.
  4. Save your Permissions settings.

6. Test, Test, Test!

Yes, once you’re done, fire up a couple of test users, one in your Established Members role and one regular authenticated user and try to post content. The Established Member should be published right away, while the regular user should see a content moderation warning.

To moderate content, Modr8 installs a page in the Content management area of your Drupal admin section. Look for Moderated Content. Managing approval from this page is pretty straightforward. You can sent little messages to your users with approval or rejection of their posts.

One last thing…

As far as I can tell, Modr8 doesn’t issue an email to the admin to alert them to new content in the queue. That’s a bit of an oversight.

However, by happy coincidence, I use the Antispam module with Akismet on my site. Because the new posts are set to unpublished by default, Antispam sends me an email whenever something new is in the queue.

Finally, a big thank you to Michelle Cox for her advice to look at these two modules!

11 thoughts on “Drupal Howto: Use Modr8 and Modr8 Bypass to protect your site from spam

  1. I been trying to get the modr8 module to work for me and I think I’m missing something.  I’m not going to open up user blogs or allow content contribution is other areas. I only need it to moderate my forums. Right now I cannot get entries from my test account to appear in the moderation que block.  So I’m wondering if I’ve failed to select the content types that I’d like moderated or missed something else?Your check list is great but I wonder if you would be so kind as to include all of the setting you tweaked during the process so I can compare my notes  or retrace my steps bt your process.  (or if you found instructions somewhere else a link would be great)Props on a the first good and friendly explanation of how to set up this module.ThanksMike  

    1. gerard

      Why not Mollom? I use Mollom on the site for comment moderation, but I found that when I had it switched on for content submissions (blog posts, etc) that it became intrusive for users. And it wasn’t 100% foolproof either.Granted, that was quite a while ago, and Mollom has gone through several upgrades since. Things might be different now. 

      1. I’m fine with using Mollom to fight spam. It’s been great at keeping bots out just using it on the registration page. But I’d like to skip the added step/trouble for my 750 verified users.If I’m crazy – really please say so.  I’d love to go back to the committee and tell them that people that have done this before are telling me that I’m wasting my time trying to do it this way. Mike 

  2. My sites has 2 primary purposes -provide well reseached info on topics that revolved around our local political scene in Blacksburg, VA and offer openions and recommend solution when we / if we reach a consensus.Provide forums for citizens to raise concers and discuss issues.I do use mollom for user reistration, but not currently for Content Contribution.  The “scheme” that was developed by our web committee for CC, is suppose to employ a work flow that can allow our 750 existing community members to submit their thoughts without moderation, but any new members must be vetted to be promoted to a “trusted” user type after content evaluation for spam and actual relivancy to the discussion.I thought the modr8 module might be able to help me accomplish the goals of that scheme.  But your question makes me wonder if that might be overly onerous on the web admins (perpetually updating user types) and the users (waiting on moderation approval) or if there is another, simpler solution?

    1. gerard

      Mike, the next stage in implementing moderation is to find a way to automate elevating user roles – one suggestion is by User Points (and with Modr8 in place, you can’t actually earn points until your content has been published) or some combination of length of membership and contribution.I’m told that there are modules out there that can do this. Just reading over your earlier comment – did you get the Modr8 module working as I’ve outlined here?

  3. sandeep

    How to have adminstrator approval before forum post is posted?i want when anonymous user create a forum it should go admin approval?????????

    1. gerard

      Sandeep, I haven’t tried that particular configuration, but I’d imagine if you’ve given anonymous users the permission to post content, then the modr8 module should still do its job. Have you got a test version of your site? If not, I heartily recommend building one – you could test this out in about half-an-hour.And from what I can see, Modr8 hasn’t been upgraded for Drupal 7 yet.

  4. sathya

    When user uploaded the content into the site it will go and sit in moderation queue.that’s nice.But is it possible to send Email notification to the admin about “the user uploaded some content into the site and you need to approve or reject that content”…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s