They open a page and then leave immediately. What's the best practice to fight it? Time 1-2 s, bounce rate = 100%  I googled several services, for example this one shows this IPs like spam, but they are fighting spam comments, not total IP blocking.
58228
This is a question to experienced people that might help us shed some light on the issue.   We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from Kouvola city is hitting one of our pages - only one page on our site, 'bout a hundred times per day, all with an average bounce rate of 90%+...  This is causing our overall bounce rate to go up by 1 to 3% per day... which is very disturbing.. since we're trying to do our best in order to keep it as low as possible. And obviously having it jumped from ~24% to 27%, just because of that crazy dude is not making us happy at all... We tried implementing a geo-targeted script in order to catch this particular visitor and deliver him a juicy message, and it seemed like it helped in the beginning, it has stopped for a day or two, but now he's back...   The geo-targeted script was also logging all IP addresses for page requests originating from Finland in order to find out more details and (in order to block them on the server level, later).. but thing is, it was all mainly cable or DSL connections with various, but not constantly repeating IPs... we are all wondering what is he up to really ?   I think that this page should be kept updated with ideas on how to combat this and perhaps someone could also shed light on what it might be ? What is the reason for doing this "bounce-rate attack", as I call it?  There was a similar question asked on stackoverflow earlier, with no meaningful answer - here -
12677
We've been . Some of us were getting frustrated that some users were smashing through 20 reviews in a minute so I decided to lay down the law.  Aaaanyway, as part of this  brought up the problem that if they take too long being diligent (looking into duplicates properly, checking rules, etc) there's a very good chance that somebody else will have reviewed that post and their decision (and the time that went into it) is wasted. That doesn't seem like a fair reward for what is an otherwise thankless task.  So I'm suggesting the a review "reservation" system so only one person can review something at once:   Once something is opened in review, it becomes unavailable to other users to review. That includes other queues. A reservation or lock should be against a post, not a post in a queue. The reviewer should get, for example, two minutes of alone-time with a post. If they review before their time is up, the lock goes away. If they're still reviewing when their time runs out, a notification should pop up (audio too?) and allow them to request an extension... Perhaps with 10 seconds grace to stop somebody else being allocated something. Questions are simply allocated on a first-unlocked-post basis. There should be a safety-limit on the number of times something can be review-locked or extended so that somebody can't wrongfully extend the life of a bad post (offensive/spam/etc) by gumming up review.   It sounds messy (and there's certainly some concurrency issues if you've split the servers out horizontally) but data-wise, it's actually not too hard to implement (speaking as somebody who has implemented an edit-lock system before).  Above all else, it shows reviewers the respect they deserve for a job that few of us really want to do.
104127
As a response to the recent  and , what is the best way to secure your website against brute force login attacks?  Jeff's post suggests putting in an increasing delay for each attempted login, and a suggestion in the comments is to add a captcha after the 2nd failed attempt.  Both these seem like good ideas, but how do you know what "attempt number" it is?  You can't rely on a session ID (because an attacker could change it each time) or an IP address (better, but vulnerable to botnets).  Simply logging it against the username could, using the delay method, lock out a legitimate user (or at least make the login process very slow for them).  Thoughts? Suggestions?
44778
I share a public IP with my colleagues here in the office, and sometimes I get the following error message:     Sorry, you are only allowed to ask 6 questions in a 24 hour period.   I was hoping if you guys can add a time reset indication like, "You will be able to ask again after 2 hours," where 2 hours is the remaining time till the 24 hours limit ends.  What do you think?
28349
I was just looking at  and they seem to be using the Stack Overflow engine or Stack Exchange.  But it seems to be hosted on their servers. How is that possible?
96284
It is common practice for operators of web services (e.g. web sites) to block IP addresses when there was malicious traffic originating from that address.  It is also common practice that internet users don't have a static IP address but get one assigned by their ISP via DHCP.  Now I would expect that it sometimes happens that a specific IP address gets banned from a service and later that address gets assigned to another user, leaving the new user (temporarily) banned from the service for no apparent reason. However, I never had this problem or heard of someone having that problem.  Does this sometimes happen? If not, what prevents this from happening?
22123
I have just been looking through the questions to answer those that I can and as I go to the next page (using the Next button at the bottom) I am presented with the same questions.  I imagine this is not a flaw and in fact questions are coming in fast filling up a page pushing my current page to the next one.  An idea to solve would be to set a variable for starting id when I start paging and only clicking an update button will reset the starting id.
15265
A high-reputation, highly-active user has already been dinged once for a sockpuppet, and I just dinged him again. He probably has another sockpuppet as well.   What are the guidelines for handling users who game the system in this fashion? Specifically,   How can I be sure I'm looking at a sockpuppet? When should sockpuppets be considered a problem? How should moderators handle problematic sockpuppets once they've been identified? I was suspended for sockpuppetting and feel this is unfair
4785
Does Google consider bounce rate or something similar in ranking sites?  Background: here at Stack Exchange we noticed that the latest Google algorithm changes resulted in about a 20% dip in traffic to  (and a much smaller dip in traffic to ). Stack Overflow traffic was not affected.  There was an  which hypothesized that bounce rate might be a ranking signal in Google's latest Panda update.  According to Google Analytics, these are our bounce rates over the last month:  Site           Bounce Rate Avg Time on Site -------------  ----------- ---------------- SuperUser      84.67%      01:16 ServerFault    83.76%      00:53 Stack Overflow 63.63%      04:12   Now, technically, Google has no way to know the bounce rate. If you go to Google, search for something, and click on the first result, Google can't tell the difference between:   a user who turns off their computer a user who goes to a completely different web site a user who spends hours clicking around on the website they landed on   What Google does know is how long it takes the user to come back to Google and do another search. According to the book  (page 47), Google distinguishes between what they call "short clicks" and "long clicks":   A short click is a search where the user quickly comes back to Google and does another search. Google interprets this as a signal that the first search results were unsatisfactory. A long click is a search where the user doesn't search again for a long time.   The book says that Google uses this information internally, to judge the quality of their own algorithms. It also said that short click data in which someone retypes a slight variation of the search is used to fuel the "Did you mean...?" spell checking algorithm.  So, my hypothesis is that Google has recently decided to use long click rates as a signal of a high quality site. Does anyone have any evidence of this? Have you seen any high-bounce-rate sites which lost traffic (or vice-versa)?
24260
I don't think  deserved to get  deleted as spam. Martin'Vobr vas Rebex linked to a product he makes as an example of a library to accomplish the task the OP sought, and did so in a way that made it clear that he is the creator of the library and therefore his word should be taken understanding that he is biased.  Do you think he did anything underhanded in his answer? Here's the "spammy" part, for those without ten thousand arbitrary numbers:     I would try the code from the codeproject and if it suits your needs stick with it. In case of too many parsing problem the commercial email component with decent support could be a wise move. I would recommend our  ($149 single dev) but I'm biased. Feel free to browse for you own favorite ;-). At least it will be (in case of any problem) someone who is paid for solving your mail parsing problem.   Ordinarily I would flag this for moderator attention but unfortunately I am not permitted to flag locked answers. Also, I'd like to know if I'm completely wrong about my understanding of what is and is not spam.  To me, this isn't spam. To six other people, it is. One of us has to be wrong, by the pigeonholing convention of '57. Can we figure this out? There are a lot of similar users to Martin who post their products, and a lot of them do it in a very spammy way. But in the specific instance of Martin I think he does it well. We can't outright outlaw all users who advocate their own libraries, can we? Those might be the only libraries that do what the asker wants, after all.
98120
I have been an active user lately on Stack Exchange Mathematics. If anyone can checkout my profile, I have posted my answers along with questions that I asked just to know if I attempted them correctly or not. I've never spammed nor abused anyone. Still I am getting this message.     You can only post 1 time each day due to the volume of spam and abuse   originating from your network.   Is there anything that can be done about this? Can I get help from any moderator?
100199
Some of the sites seem to have a much better performance than others. In particular, during Stack Overflow's first round, I found that the stats always seemed quite low, with no traffic, and no seeming way to get out of the situation.  How can one best get through the launched phase, achieving the best performance?
102106
The problem is a whole load of 404 errors, as reported by Google Webmaster Tools, with pages and queries that have never been there. One of them is viewtopic.php, and I've also noticed a scary number of attempts to check if the site is a WordPress site (wp_admin) and for the cPanel login. I block TRACE already, and the server is equipped with some defense against scanning/hacking. However, this doesn't seem to stop. The referrer is, according to Google Webmaster, totally.me.  I have looked for a solution to stop this, because it isn't certainly good for the poor real actual users, let alone the SEO concerns.  I am using the Perishable Press mini black list (), a standard referrer blocker (for porn, herbal, casino sites), and even some software to protect the site (XSS blocking, SQL injection, etc). The server is using other measures as well, so one would assume that the site is safe (hopefully), but it isn't ending.  Does anybody else have the same problem, or am I the only one seeing this? Is it what I think, i.e., some sort of attack? Is there a way to fix it, or better, prevent this useless resource waste?  EDIT I've never used the question to thank for the answers, and hope this can be done. Thank you all for your insightful replies, which helped me to find my way out of this. I have followed everyone's suggestions and implemented the following:   a honeypot a script that listens to suspect urls in the 404 page and sends me an email with user agent/ip, while returning a standard 404 header a script that rewards legitimate users, in the same 404 custom page,  in case they end up clicking on one of those urls. In less than 24 hours I have been able to isolate some suspect IPs, all listed in Spamhaus. All the IPs logged so far belong to spam VPS hosting companies.   Thank you all again, I would have accepted all answers if I could.
30111
I've just started getting these messages:     Please avoid extended discussions in comments. Would you like to automatically move this discussion to chat?   Why should one avoid doing this? I think it adds to the site...  (Tagged  in more ways than one!)
45038
Looks like flagging has been affected by releases today. Are these intended effects?   Higher daily limits (appear doubled for me, flagging of posts limit also doubled).  Explained by Shog9 below. Soft comment deletion  - e.g. for "accept rate" obsolete comments - it does in fact work, but the immediate feedback is gone.  This is fixed now. Has the throttling rate changed?  Seems possible to repeated flag without waiting 5 seconds.  If it was broken, it isn't anymore. Old soft deletions that were neither categorised as "helpful" or "declined" have all become "helpful".   If limits have been updated, can we get the new formula published? Not changed, as confirmed by Shog9.
21924
Of course spam posts should be flagged, and if they come up in review, rejected.  Over on Mi Yodeya during the past 24 hours I’ve helped delete and reject four spam posts through the review queue, and I can only imagine that others were posted over the course of the night. To clarify, I’m referring to edits and answers that were about 99.274% words that I don’t think any decent person would use in everyday discussions, even if someone got them really angry.   Thing is, if the only thing we can do as a community is delete his posts/reject his edits, and as moderators to ban his account, can’t he just create a new account? Further, some of these posts . Maybe the mods can ban his IP address? I’m not one, so I have no idea what kind of power they wield in that respect. But he can always just get a new computer.   I don’t have the numbers to see what this is like on other sites, but I know this doesn’t happen often on Mi Yodeya. I wonder, then, whether this is the optimal solution, or whether an automatic spam filter be put into place - say, a new review queue that automatically deletes posts or rejects edits that can then be voted on whether to be reposted if it’s a false alarm. Perhaps it can be automatically triggered by certain keywords (like ****, %$#^, or @$+^).   Now, all of these posts that I voted to delete/reject came up in Suggested Edits and First Posts. Maybe such edits would show up in Low Quality in general, and that just wasn’t the case here because of precedence rules. I don’t know. But perhaps the above would be a better solution, if this is even as big of a problem as I’m making it out to be.
108822
has now probably made around 15 accounts. He consistently uses the , , ,  and  tags, and does not ever do anything constructive.  was his latest.  Unfortunately I haven't been bookmarking his other questions, but here are some of his previous accounts:          He has also gone by many other names (Iraq War Veteran is the one that comes to mind), but those accounts have been deleted.    Is there nothing we can do about this? Deleting and suspending his accounts just seems to give him more reason to create other accounts. Is there a way to block him entirely?    Edit:  seems to have been deleted by Community ♦