Help:Wikipedia: The Missing Manual/Editing, creating, and maintaining articles/Dealing with vandalism and spam

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
Wikipedia: The Missing Manual (Discuss)

Although vandalism and spam are constant aggravations, the ongoing efforts of thousands of editors—like you—do a surprisingly good job of minimizing these problems. This chapter explains in detail what you, a Wikipedia editor, can do in terms of spotting and fixing vandalism and spam.

For Wikipedia, the "encyclopedia that anyone can edit," vandalism—the destruction of content or the addition of useless or malicious content—is a constant, ongoing issue. "Anyone" includes cranks, juveniles (of any age) who don't have anything better to do, and those who hold a grudge against Wikipedia because of past blocks or bans. For readers, obvious vandalism casts doubt on the accuracy of Wikipedia articles. If the vandalism is subtle, readers can be deliberately misinformed. For editors, fighting vandalism reduces the amount of time available to improve articles.

Spam, at Wikipedia, refers to improper external links added to Wikipedia articles, which is why you often see the term linkspam. Spam is a smaller problem than vandalism because most readers of Wikipedia articles don't follow external links. Still, as Wikipedia becomes more widely read, the temptation grows to add links in the hopes that someone will click them, generating traffic for the spamming Web site. (See the box below for more detail on the differences between vandalism and spam.)

Fighting vandalism and spam is a bit like doing detective work: In addition to figuring out who did what (Chapter 5: Who did what: Page histories and reverting), you investigate the extent of the problem, assess the possible underlying motives of the perpetrator (that affects things like warning levels), and then decide what to do (warn, request a block, and so on). It's important work, and many editors specialize in it.

Vandalism and Spam Defined

Vandalism is any addition, removal, or change of content made in a deliberate attempt to compromise Wikipedia's integrity. The most common types of vandalism include the addition of obscenities to pages, page blanking, and the insertion of jokes or nonsense. (For more information, go to WP:VAND.)

Adding external links to an article or user page for the purpose of promoting a Web site or a product is considered spam, and isn't allowed. If an editor adds numerous spam links (to the same external Web site) along with a few acceptable links, the appropriate action by other editors is to remove all links. Over time, non-spamming editors can add back any relevant links that were mass-deleted. (For more information, see WP:SPAM.)

Lines of defense[edit]

The Wikipedia community has evolved multiple lines of defense against vandalism and, to some extent, spam. They are, roughly in the order of how fast they kick in (bots being the fastest):

  • Bots. Much vandalism follows simple patterns that computer programs can recognize. Wikipedia allows bots to revert vandalism: in the cases where they make a mistake, the mistake is easy to revert.
  • Recent changes patrol. The RCP is a semi-organized group of editors who monitor changes to all the articles in Wikipedia, as the changes happen, to spot and revert vandalism immediately. Most RC patrollers use tools to handle the routine steps in vandal fighting.
  • Watchlists. Although the primary focus of monitoring is often content (and thus potential content disputes, as described in Chapter 10: Resolving content disputes), watchlists are an excellent way for concerned editors to spot vandalism. (Watchlists and other methods of monitoring articles are described in Chapter 6: Monitoring changes.)
  • Readers. Readers, including editors who are just looking over an article, are in some sense the last line of defense. Most readers don't know the proper way to remove vandalism (but you do, if you've read Chapter 6: Monitoring changes). Still, even if readers bungle vandalism removal, they've still improved the page, and hopefully a more experienced editor will complete the job.

When you read a randomly picked Wikipedia article, you rarely see vandalism. That's a testimony to the effectiveness of vandal-fighting, despite evidence that the extent of vandalism is increasing (Figure 7-1).

Figure 7-1. As Wikipedia has gotten more popular, the percentage of edits that are reverted—mostly, but not always, because of vandalism—has risen. This graph shows problem edits and the edits that fixed them. Assuming, for the sake of simplicity, that there is a one-to-one ratio of problem edits to corrective edits, then a point on the 20% line would mean that one of every 10 edits was a problem, and one out of every 10 edits was done to fix such problems. [Graph courtesy of editor Dragons Flight (Robert A. Rohde), based on his large September 2007 sampling of article edits.]

Reverting vandalism and spam[edit]

If you simply revert a vandalizing or spamming edit, and then go about other business, you've missed a major opportunity to find other vandalism and spam by the same editor. Worse, you've made it less likely that other editors will check the edit history of that editor in the future, looking for vandalizing and spam, and if indeed there are such problems, you've given the problem editor more time to continue with destructive editing.

To handle vandalism and spam the way experienced editors do, you should do three things in addition to reverting the problem edit: determine if that editor has other problem edits, and deal with those as well; post an appropriate warning to the editor; and, in extreme cases, ask an administrator to block the problem editor. Experienced editors also know how to ask that a page be protected if it's repeatedly vandalized by a number of different (typically, anonymous IP) editors.

This chapter shows you the right way to approach what looks like vandalism. For the mechanics of identifying and reverting a problem edit, flip back to Chapter 5: Who did what: Page histories and reverting.

Most vandalism is obvious. But when you encounter something you're not sure about, Wikipedia's guidelines suggest that you assume good faith in assessing the edits of others. (Details at WP:AGF.) That doesn't mean that you should excuse vandalism and spam; it means that when you encounter something that's in a gray area, investigate further, as described in this section. If it isn't clearly vandalism or spam, fix the erroneous edit, and presume it was a mistake.

As a general rule, fix improper edits and remove irrelevant links, but if the editor in question has a history of constructive edits, don't label those edits as vandalism, and don't call the links linkspam unless you find a lot of problem edits. New editors can make honest mistakes.

Consider the edit summary[edit]

Some vandals are clever enough to add a semi-plausible edit summary to a vandalizing edit. Still, if there's an edit summary, you should consider that major evidence that you're not looking at vandalism, but rather at a content dispute (Chapter 10: Resolving content disputes). On the other hand, if you're looking at a questionable edit which also lacks an edit summary, it's appropriate to lean toward treating it as vandalism.

Note that some edit summaries are automatically added by the software, such as the title of the section edited (see the section about reading a page history). The software can also add other summaries if an editor does not enter any edit summary. Many of these automatic summaries highlight obvious vandalism, such as "Blanked the page". Such automatic summaries are prefixed with a left-pointing arrow (←). For judging whether something is vandalism, treat automatic edit summaries as if no edit summary was there, since they indicate that none was entered by the editor.

Consider the source[edit]

Before you revert an edit, you should always think about who did that edit. Take the editor's history into account when you're estimating the likelihood that an edit is vandalism. Here are the two extremes:

  • Anonymous IP edit; link to user talk page is red. The red link means that no one has ever posted to the editor's user talk page, which in turn indicates that there have been few or no other edits by this IP address, which means few or no constructive edits. In this case, you don't need to do any further research before reverting. If you see a questionable edit from this kind of user account, you can be virtually certain it was vandalism.
  • Experienced editor. When you follow the link to the editor's User contributions page, you see a lot of edits with edit summaries. When you click the "oldest" link, you find that the editor has been around for years. When you check the editor's block log, you don't find anything (or anything within the past 12 months). (A user block log shows whether the user account has been blocked for vandalism or other problems. You can see the "Block log" link at the top of the User contributions page; see Figure 7-2.)
In the rare case that you think there's a problem with an edit from this kind of editor, chances are you've misunderstood something. You may have clicked on the wrong line in the history page (an edit you don't want to revert), or you may be looking (again, by mistake) at an edit that fixed vandalism rather than created it.
Figure 7-2. You can get to a listing of blocks made against a user account via a link at the top of the User contributions page. The block log shows any action taken by administrators to block the user account from editing for an hour, day, a week, or some other period, including indefinitely.

The less clearly an edit is vandalism, the more you should consider the source[edit]

Suppose you notice an edit where a date has been changed – say, from "1920" to "1921," or the middle name of a person has been changed from "Smith" to "Smithers." Is it vandalism or not? When you check the page history, you see this isn't just a revert to the way the article had been earlier—it's a new change. You need more information.

Ideally, the article would have a citation that included an external link, so that you yourself can verify the information in the article. But if no external link provides an answer, even in the "External links" section, then information about the editor can help you decide what to do. Start by looking at the link to the user talk page. If it's a red link, there's no user talk page, so the user account is almost certainly new. You should then basically revert on principle, because it's more likely that the original information was correct than the change made by an editor who's apparently brand-new to Wikipedia. If the link to the user talk page is blue, follow it. If there are warnings, then again it's likely that the edit you're examining is vandalism.

If the editor in question is registered, not an anonymous IP editor, and there's no evidence that the editor is a vandal, then it's a courtesy to drop a note on the editor's user talk page, saying you've reverted the edit due to lack of an edit summary and lack of a citation, and that the editor should feel free to make the change again if an explanation is provided. Notes like that help inform new, well-intentioned editors about the right way to do things.

If the questionable edit you're examining was done by adding text to an article, not by deletion or changing of information, consider alternatives. You can, for example, add the Citation needed template (type {{citation needed|date=November 2022}}) to the end of a sentence or paragraph that you question, rather than deleting it. You can also edit it a bit to make the language more neutral.

If the added material is biographical information, immediate deletion may be appropriate. Wikipedia's rules regarding biographical information are different from rules for other types of information. If information is controversial—whether the information is negative or positive—and it's unsourced, you should remove it. But don't call it vandalism if it's at all coherent. Rather, you should note the violation of the policy Wikipedia:Biographies of living persons in your edit summary. Something like this will do the trick: Removing unsourced information in violation of [[WP:BLP]].

Explain your edit[edit]

When you revert vandalism and spam, it's critical to leave a clear edit summary. If you're dealing with obvious vandalism by a user account with no apparent history of constructive edits, then rv will suffice. That abbreviation tells experienced editors that you've reverted vandalism; it's fine that it's cryptic because communication with the editor who did the obvious vandalism is unlikely. With less clear cases, your edit summary needs to be lengthier because it may be the start of a dialog with another editor.

For example, if you suspect a subtle form of vandalism like changing a date or name but can't prove it, something like rv edit unsupported by a citation; edit made by a user without history of constructive edits is appropriate. Think of your edit summary as a sort of log entry; even if you're incorrect, you've still started a constructive dialog by explaining yourself.

If another editor has deleted a bunch of text but doesn't offer any explanation in the edit summary, a good edit summary for your reversion would be rv unexplained deletion. This summary explains why you restored the text and invites that editor to add an edit summary next time.

Dealing with Vandalism When You Have a Conflict of Interest

Wikipedia's conflict of interest guideline (shortcut: WP:COI) says that editors generally "are strongly advised not to edit articles where they have a close personal or business connection." But it makes an exception for "non-controversial edits," which include the removal of spam and the reverting of vandalism.

If you find yourself in a conflict of interest situation, the important thing is to make sure that what you're reverting is vandalism, not something else. In particular, Wikipedia's vandalism policy (shortcut: WP:VAND) says that the following are not vandalism: edits that are not neutral in point of view, bold edits that substantially change text, and misinformation added in good faith.

If the problem is something other than vandalism, like inaccurate information, then simply post to the article talk page, citing a source (ideally providing a link) for what you want changed. (Wikipedia's conflict of interest guideline says that you don't have to volunteer that you have a conflict of interest if you don't want to, but it may help here, since other editors may wonder why you don't just fix the article yourself.)

Looking for more vandalism and spam[edit]

Some vandals hit only one page; some hit many. Spammers typically hit many pages, but sometimes only one (or they're caught early in a spamming spree). A good editor, upon finding one problem edit, looks for others. The place to do so is the editor's User contributions page. After you've identified the problematic edit, and are looking at a history page, you can jump to the contributions page of the problem editor in one of two ways:

  • For anonymous IP editors, click the IP address.
  • For registered editors, clicking the "contribs" link.

At the User contributions page, focus primarily on edits done in the past couple of days. But your first concern should be those edits which have a "top" in bold at the end of the row (see Figure 7-3). If an edit was vandalism or spam, and it has a "top" at the end, that means it has not been reverted.

Figure 7-3. A portion of a User contributions page, showing two edits with "top" at the end of the row of edit information. The "top" means this editor was the last person to edit that page – their edit is at the top of the revision history of that page.
Edits by a person to their own user talk page and (if they're a registered editor) to their user page are probably worth at least glancing at, particularly in the case of spam, but can be given much lower priority. Focus on articles and on other widely read pages.

How you go about reviewing a specific editor's edits is a matter of personal style. Here are some tips:

  • Start with "top" edits, as shown in Figure 7-3, since they clearly haven't been reverted. If they're a problem, fix them immediately, if possible. And look at all the other edits the editor did to the same page—they won't be "top" edits, but they also may be unreverted.
  • Just because an edit isn't a "top" edit doesn't mean it's been fixed. It means only that the page has been subsequently edited, perhaps by someone else who completely missed vandalism or spam. Or a bot could have stopped by to fix a category or do other maintenance work, oblivious to any other problems.
  • A registered editor who has vandalized or spammed an article represents a significant problem. Registered editors can do much more than anonymous IP addresses (creating pages, moving pages, and so on). Vandalism-only registered accounts in particular need to be dealt with promptly.
If you find a registered editor who has done more than a couple of edits, all these edits are vandalizing, and the most recent edit is in the last 24 hours or so, then don't bother posting a warning. Instead, ask an administrator to block the account (see the section about reporting vandalism). (If the administrator reviewing the case decides not to block, they'll post a warning as an alternative.)
  • Multiple people can be using the same IP address: a library or school computer; a dial-in IP address that's constantly reassigned; an Internet service provider who uses a proxy address for multiple customers; and so on. In these cases, older edits may have been done by a completely different person, so don't use them in analyzing what an IP user account did in the recent past.
  • For linkspam, if the editor is posting the same link to multiple articles, you can query Wikipedia to see how many of the links still exist (that is, no one else has deleted them yet). To do so, go to the Special:LinkSearch page, and put in the URL (see Figure 7-4 for an example).
Figure 7-4. You can use the Special:LinkSearch page to find all Wikipedia pages with an external link to any specific URL. It even finds all Wikipedia pages with external links to a particular Web site if you use the "*" wildcard character. In this figure, a specific URL has been entered, rather than searching for links to a portion of or all of a Web site.
If the vandalism you find is very fresh—say, some of it is less than 10 minutes old—you probably should wait to see if other editors find it and deal with it before reporting it to the Help desk, assuming you lack time to fix it yourself. On the other hand, if everything you see is over an hour old, that's definitely worth reporting, since the Recent Changes Patrol probably missed it.
Don't feel your reporting a problem is just shifting the workload to other editors. Wikipedia has power tools—including some available only to administrators—that can do mass reverts, which sharply reduces the amount of work in dealing with a problem editor. So when you post at one of these two pages, you're helping make sure that problem edits get fixed quickly. That's particularly true for the spamming of a large number of pages—if you don't have a lot of experience with reverting, it's really not worth your time to manually remove spam links from lots of pages, since some editors specialize in this.
  • Vandals often edit the same page multiple times, so make sure you get them all. Often other editors have fixed most of the vandalizing edits, so do a diff (see the section about diffs) that includes the vandalism and its repairs (a diff on multiple edits) to make sure that the net impact of fixing vandalism was to bring the article back to its state before the vandalism. (It can be reassuring to know that others have been dealing with this problem editor.)
  • When you're investigating an editor, it's normal to focus, at the User contributions page, only on edits in the past couple of days (or, if there are few edits, to look at the last dozen or so, perhaps even fewer). Reviewing older edits has much less payback; should you find one that wasn't fixed, it presumably was to a page that gets few readers, so it didn't have a great impact anyway. Plus, the older an edit, the more likely that there have been a number of subsequent edits, making it more difficult to figure out whether the vandalism got fixed (properly) or not. However, if you're checking for vandalism by a registered editor, you should review every page where that editor has a "top" edit, no matter how old that "top" edit is.
Using an article as a sandbox

Although they shouldn't, brand-new editors often do an erroneous edit to an article, then immediately do another edit to repair the damage. This behavior is not considered vandalism, if this is the first time, or the editor hasn't been told to stop doing it, because vandalism requires what Wikipedia calls bad faith. Such edits shouldn't be ignored, but someone who cleans up after themself shouldn't be treated harshly, either.

For such cases, the best thing you can do is post a standard welcome on that editor's user talk page, assuming one isn't there already, to provide them with some useful starting links, plus a gentle suggestion to use the sandbox for playing around. Type the following warning template on the user talk page:

{{subst:uw-test1|Article}} ~~~~. (That may look odd, but you'll see, once you preview it, it makes sense. You'll find information on these warnings via the shortcut WP:WARN.)

If the editor has already been warned about not editing actual articles, use a stronger warning: use "uw-test2" or "uw-test3" instead of "uw-test1". Finally, if there have been repeated warnings, then treat the matter as pure vandalism.

Issuing warnings[edit]

So, you've found some vandalism or spam, and researched other edits by the same user account to see if there's more. The next, and important, step is to post an appropriate warning on the editor's user talk page.

The primary purpose of a warning about vandalism or spam, perhaps counter-intuitively, is not to get the problem editor to change their ways. (It would be nice if they did so, but troublemakers aren't like to reform themselves just because someone asked nicely.) Rather, when you and other editors post a series of increasingly strong warnings, you're building a documented case for blocking a user account from further disruptive editing. If the warnings lead to the editor changing their ways before blocking is necessary, great—but don't hold your breath.

Choosing the warning and warning level[edit]

Start by looking at the warnings that have already been posted on the user talk page, if any. Then take a look at the history tab for the user talk page: the editor might have deleted warnings by other editors.

There's much confusion as to whether editors are allowed to remove warnings from their user talk pages. They are. Deletion is considered to be confirmation that the warnings have been read, and the warnings remain visible via the "history" tab. For details, see the "Removal of comments, warnings" section of the guideline Wikipedia:User page (shortcut: WP:USER). So you must check the user talk page's history to see if prior warnings were deleted, but don't revert those warnings so that other editors can see them on the user talk page.

You'll find a table of warnings at Wikipedia:Template index/User talk namespace (shortcut: WP:WARN). Warnings to editors come in levels 1 through 4:

  • Level 1. Assumes good faith. Generally includes Welcome to Wikipedia or some variant.
  • Level 2. No faith assumption.
  • Level 3. Assumes bad faith; cease and desist.
  • Level 4. Assumes bad faith; strong cease and desist, last warning (this level of warning must be preceded by at least one prior warning).
  • Level 4im. Assumes bad faith; strong cease and desist, first and only warning.

From the warning table, pick an appropriate warning at the level you've chosen. Picking the appropriate level of warning is an art, not a science. Here are some general guidelines:

  • You don't have to start at level 1, nor do you have to escalate if the editor seems to have generally behaved after getting a prior warning, but you should always post some level of warning, or a note, when you find a recent problem.
  • If you're not sure about what level of warning to post, pick one, post it (as described in the next section), and do a page preview. If the wording doesn't seem to fit, go up or down a level and see what that looks like.
For example, assume that you found vandalism, and that a level 2 warning had already been posted for that same type of vandalism. You should post a level 3, or, if you just found a lot, perhaps even a level 4 warning.
  • If there already was a level 4 (final warning), you can normally skip directly to the next step—asking an administrator to block the user account (see the section about reporting vandalism).
Exception: If the most recent vandalism or spam by a user account is older than 48 hours, administrators don't usually put a block in place. Blocks are preventive, not punitive (see the section about blocking vandals). So if you find old vandalism and a prior level 4 warning, it may be helpful to post another "final warning" as a note to other editors not to give this user account any leeway in the future.

Posting the warning[edit]

Once you've selected an appropriate warning template, posting it is a quick five-step process. (If you're not dealing with a real situation, you can still practice this procedure by posting to your own user talk page. Just don't click "Publish changes". Instead, in the last step, stop after doing the preview.)

1. On Wikipedia:Template index/User talk namespace (shortcut: WP:WARN), copy the text of the template warning to the clipboard (Ctrl+C on Windows; ⌘-C on Mac).

This step is optional, but may save you time later. Or you may want to use the clipboard for something else, like the name of the page where the problem edit occurred.

2. On the user talk page where you want to post the warning, click the "+" tab at the top to start a new topic.

3. You're in edit mode, with a new section visible for you to edit.

4. In the subject line, type Warning or something more specific like Warning – your edit to [[Name of article]].

It's important to use neutral language here. Your primary goal is to provide information to other editors, not to chastise someone you think is a vandal. If you get personal (expressing emotion, and/or commenting on the editor as a person), you run a serious risk of either biting a newcomer (see WP:BITE for details) or feeding a troll (see WP:DENY and WP:DIV for details).

5. In the body of the new topic posting, paste (or type) the template, with {{subst: at the front and }} at the end, followed by tildes for your signature (for more on signing your comments, see the section about signing comments).

For example: {{subst:uw-vandalism3|Article}} ~~~~
Template substitution

When you post a warning template, always start the template with {{subst:. This code tells the software to use the template page to post the standard wording, and then to lock that wording in place. In other words, when you publish the edit, it pastes the actual text into the page's wikitext in place of the template you typed.

Reasons for including the subst: include the following: When an editor looks at the underlying wikitext, they see the same text as on the page, not something like {{uw-test1}}, which can confuse new editors. Also, the locked text never changes, even if the wording of the warning template changes in the future, so your warning's intent remains clear. Finally, it's slightly less work for Wikipedia's servers to display the wikitext of a page rather than going to a template page to find and process the template to get that text. If you forget to include the subst:, a bot will usually add it for you.

6. Click "Show preview" to make sure everything worked as expected (see Figure 7-5).

7. If everything looks okay, then click "Publish changes".

If you are warning a user identified by an IP address, it may also be worthwhile to perform a WHOIS lookup on the address (The WMF has a tool to carry this out). Use the results from this to place a suitable WHOIS template, from the table on this page, on the users talk page. In some circumstances a user realising their ISP, business, or school can be traced, may lead to a cessation of the vandalism.

Figure 7-5. A preview of the level 3 user warning for vandalism (the uw-vandalism3 template, using substitution). It's critical to preview user warnings, because mistyping even a single character will probably cause the template to malfunction.

When not to post a warning[edit]

It's generally not worth posting a warning in these cases:

  • If you find older vandalism, and the editor's already been warned. Adding a warning is appropriate only when a new type of problem arises, or when someone has ignored a prior warning and continued some improper behavior.
  • If the user received a level 4/4im, last/final warning, and vandalized after that. Just request the user be blocked, as described in the section about reporting vandalism below.
  • If an anonymous IP address vandalized only a single page, on a single occasion (including consecutive edits), and has never done any other editing. Here you're dealing with a hit-and-run vandal. It's highly unlikely the vandal will reappear with that IP address, so nobody's going to read any warning you post, and there's no point in laying down an initial warning for other editors to build on.

Wikipedia has a well-known saying: "Don't template the regulars." As discussed above (see the section about considering the source), someone who has a long history of constructive edits isn't likely to have done a vandalizing or spamming edit. If it looks like they did, you should double-check and triple-check before proceeding. And if you do conclude that their edit looks non-constructive and revert it, don't use a warning template to post a message: Write something more personal. (For example, you might post something like I'm not sure I understood {{diff|Some page|prev|234567890|this edit that you did}}, I reverted it because it looked like a mistake; please let me know if I missed something.)

Typical usage of {{diff}} is of the form {{diff|PAGE NAME|prev|REVISION ID|LINK TEXT}}. Replace PAGE NAME with the name of the page, and LINK TEXT with the text to display for the link. Replace REVISION ID with the number at the end of the diff page's URL, which appears after 'oldid=' in the URL. If you want a diff that is not comparing to the previous revision, then replace 'prev' with whatever appears after 'diff=' in the diff page's URL. There are similar templates for generating 'polite' links to other special pages, such as {{history}} and {{search link}}.

Requesting assistance of administrators[edit]

In cases of vandalism and spam, administrators (there are 1,023 of them at the English Wikipedia) can take two types of preventive measures unavailable to normal editors—protecting pages and blocking vandals.

Protecting pages[edit]

If a page is repeatedly vandalized by a changing cast of anonymous IP editors, then temporary semi-protection of the page is probably appropriate. Semi-protection means that registered editors can still edit the page (starting 4 days after they register), but anonymous IP addresses can't. (Anonymous users with suggestions for changes should post them to the article talk page.) It's quite unusual to fully protect a page because of vandalism; full protection is normally done only for cases of major content disputes (see Chapter 10: Resolving content disputes).

In the first sentence of the prior paragraph, two key words are "repeatedly" and "changing." You shouldn't request semi-protection of a page unless there have been at least a half-dozen vandalizing IP edits in the last 24 hours or so. If there are fewer, administrators may feel that it's better to simply manually revert the vandalism. And the IP addresses need to vary or otherwise be unblockable. Otherwise, administrators prefer blocking a few IP addresses.

To request semi-protection, post at Wikipedia:Requests for page protection (shortcut: WP:RFPP).

Note that semi-protection is normally only temporary: The goal is to get vandals to lose interest in the protected page. Anonymous contributions have built a significant percentage of Wikipedia, so the Wikipedia community is very reluctant to close off editing to all IP addresses for an indefinite period, even to only a single page.

Don't ask to have a page be protected because you anticipate that it'll be a target for vandals in the near future. That's too subjective for administrators, no matter how well-reasoned a case you may have. You must show that vandalism is already occurring.

General guidance on blocking vandals[edit]

Blocking is a preventive action, not a punitive one. If, for example, you find vandalism that's more than a day or two old (different administrators have different thresholds), it's pretty unlikely that your request to block the account will be granted.

An administrator can block an account for any amount of time between a minute and indefinitely. Registered accounts whose only edits have been vandalism are typically blocked indefinitely, but other user accounts usually get an escalating approach. For example, block for a day; if vandalism recurs, block for a week; if it recurs again, block for a month; and only then, if it recurs again, block indefinitely.

Reporting vandalism[edit]

In this tutorial, you'll report a fictional vandal, an anonymous user who edited from IP address, and who vandalized six articles about an hour ago. You'll go through all the steps of making the report, except that on the final step, after you do a preview, you'll just close the page rather than saving your edit. (Since it's a fictional vandal, you don't want to make a real report.)

Report vandalism only when you think the problem has risen to the level where warnings are no longer appropriate. Generally, that means that either the user has already received a level 4 warning, and continued to vandalize, or that this is a vandal-only registered account, or that the account gives indication of a sophistication of edits well beyond a typical new editor. (Remember: If you decide to post a warning, do not also report the vandalism to administrators for their review.) In this example, IP address has already been blocked, 2 days ago, for 24 hours, for vandalism.

1. Go to Wikipedia:Administrator intervention against vandalism (shortcut: WP:AIV).

The top of this page is shown in Figure 7-6. It starts out with guidelines on when to report vandalism, much like you're already read in this chapter.
Figure 7-6. The page Wikipedia:Administrator intervention against vandalism contains instructions about reporting vandalism, including other pages where you should go if you're not reporting simple vandalism.

2. Scroll down to the section titled "User-reported", and click the "Edit" link on the left of that section title to open the section for editing.

You'll see something like Figure 7-7. Three lines begin with an asterisk. You want to copy one of these three lines to use as the base information for your posting, which you'll do in the next step.
Figure 7-7. You see this initial screen when you go into edit mode to enter information about the vandalizing account. Typically, you see a few accounts that were just reported by other editors and haven't been fully processed yet. As you see here, you use different templates for reporting IP editors and for reporting registered users.

3. In this case, since this is an IP vandal, copy the first of the asterisked rows to the bottom of the section, and then change the characters IP to

Your screen should now look something like Figure 7-8.
Figure 7-8. Your screen looks like this after you've started your vandal report. Note that you're using the IP vandal template, not the template for registered users. The text you've copied and pasted has been highlighted.

4. Replace the words provide a reason (keep it short) with user was blocked for vandalism two days ago; has done it again, and then add the edit summary Reporting Click "Show preview".

Your screen should now look like Figure 7-9 In this example, you didn't give details about the vandalizing edits—not the number of edits, or the names of the vandalized pages, or edit diffs. Administrators checking your report will review the User contributions page and the user block log, and that should suffice. (If the editor had been repeatedly warned, but never blocked, you'd say something about the warnings.)
Your goal should be to make as convincing a case as you can in 20 words or less, remembering that the administrators who handle these cases look at hundreds every day, and don't rely particularly heavily on the reports for anything but an initial starting point.
Figure 7-9. The vandalism report is complete. Here's what it looks like in preview mode.

5. Close the preview window without saving, so you don't send the administrators off on a wild goose chase.

That way, you avoid getting a polite notice on your user talk page asking you to stop submitting bogus vandalism reports.
Avoid Edit Conflicts on WP: AIV

Postings to the Wikipedia:Administrator intervention against vandalism page are among the most likely to involve edit conflicts, because the volume of vandalism reports is so high. Here's one way to avoid the problem:

  1. Write out your full posting at WP:AIV, in edit mode, in the edit box.
  2. Copy that text to the clipboard.
  3. Click your browser's Back button to go back to the WP:AIV page in read mode.
  4. Click the edit button on the "User-reported" section to go back into edit mode.
  5. Paste your report from the clipboard. Now you're ready to quickly add an edit summary, do a quick preview, and save your posting.
When Vandals Don't Get Blocked

I went to the trouble of reporting a vandal who had repeated warnings and kept messing with pages. When I went back to check, the admins hadn't blocked them. What gives?

Most editors don't bother to follow up on their reports at WP:AIV, since the admins who work on these reports are conscientious, and blocking is always a judgment call. Still, if you reported a user or IP address for administrator intervention against vandalism, you may be curious about what happened, or notice later that the user wasn't blocked. (The editor's User contributions page has a link to the block log.)

WP:AIV reports aren't archived, since their sheer volume (many hundreds per day) makes that almost pointless. But you can still usually find out what happened by checking the page history, because most administrators explain in their edit summary why they're removing an entry without blocking an IP address or user. (Change the page history to show 500 entries at a time, or you'll be paging through it for a long, long time.)

Don't Get into a Revert War[edit]

If you remove what you consider vandalism, and the same editor puts it back, don't automatically remove it again. Before reverting, you need to decide if this is a content dispute (Chapter 10: Resolving content disputes) or just a persistent vandal. Here are the factors you should consider:

  • Is it clearly a case of vandalism? If, for example, the edit again replaced good content with a string of gibberish, then you don't need to consider other factors—it's vandalism. On the other hand, if the editor simply re-deleted a paragraph, perhaps it wasn't.
  • Did the editor post anything about this matter on the article's talk page? If so, except for cases of extremely obvious vandalism, treat the matter as a content dispute.
  • Did the other editor provide an edit summary when they reverted your edit, explaining their edit? If so, you should treat the matter as a content dispute, not a matter of vandalism, assuming that all the other factors don't point to vandalism. But if the editor failed to provide an edit summary (other than what Wikipedia added, such as section title), lean in the direction of repeated vandalism.
  • What's the editor's history – other vandalism or constructive edits? As discussed in this chapter, the editor's user talk page (including its history), block log, and User contributions page provide you with a wealth of information about the editor. If they indicate that the user has at least some positive contributions and hasn't been recently blocked, treat the matter as a content dispute.

What if you revert an edit the second time, and the same editor (or another IP address that it appears the same editor has migrated to—say, an IP address that previously had no edits whatsoever) does the edit (or a very similar one) for a third time? Then you want to read Wikipedia:Three-revert rule (shortcut: WP:3RR) very carefully. If you're absolutely sure that any reasonable editor would agree that you're fighting vandalism, go ahead and revert again. But if there's any doubt at all, go to Chapter 10: Resolving content disputes.