Although vandalism and spam are constant aggravations, the ongoing efforts of thousands of editors—like you—do a surprisingly good job of minimizing these problems. This chapter explains in detail what you, a Wikipedia editor, can do in terms of spotting and fixing vandalism and spam.
For Wikipedia, the "encyclopedia that anyone can edit," vandalism—the destruction of content or the addition of useless or malicious content—is a constant, ongoing issue. "Anyone" includes cranks, juveniles (of any age) who don't have anything better to do, and those who hold a grudge against Wikipedia because of past blocks or bans. For readers, obvious vandalism casts doubt on the accuracy of Wikipedia articles. If the vandalism is subtle, readers can be deliberately misinformed. For editors, fighting vandalism reduces the amount of time available to improve articles.
Spam, at Wikipedia, refers to improper external links added to Wikipedia articles, which is why you often see the term linkspam. Spam is a smaller problem than vandalism because most readers of Wikipedia articles don't follow external links. Still, as Wikipedia becomes more widely read, the temptation grows to add links in the hopes that someone will click them, generating traffic for the spamming Web site. (See the box below for more detail on the differences between vandalism and spam.)
Fighting vandalism and spam is a bit like doing detective work: In addition to figuring out who did what ( Chapter 5: Who did what: Page histories and reverting), you investigate the extent of the problem, assess the possible underlying motives of the perpetrator (that affects things like warning levels), and then decide what to do (warn, request a block, and so on). It's important work, and many editors specialize in it.
Vandalism is any addition, removal, or change of content made in a deliberate attempt to compromise Wikipedia's integrity. The most common types of vandalism include the addition of obscenities to pages, page blanking, and the insertion of jokes or nonsense. (For more information, go to WP:VAND.)
Adding external links to an article or user page for the purpose of promoting a Web site or a product is considered spam, and isn't allowed. If an editor adds numerous spam links (to the same external Web site) along with a few acceptable links, the appropriate action by other editors is to remove all links. Over time, non-spamming editors can add back any relevant links that were mass-deleted. (For more information, see WP:SPAM.)
The Wikipedia community has evolved multiple lines of defense against vandalism and, to some extent, spam. They are, roughly in the order of how fast they kick in (bots being the fastest):
When you read a randomly picked Wikipedia article, you rarely see vandalism. That's a testimony to the effectiveness of vandal-fighting, despite evidence that the extent of vandalism is increasing (Figure 7-1).
If you simply revert a vandalizing or spamming edit, and then go about other business, you've missed a major opportunity to find other vandalism and spam by the same editor. Worse, you've made it less likely that other editors will check the edit history of that editor in the future, looking for vandalizing and spam, and if indeed there are such problems, you've given the problem editor more time to continue with destructive editing.
To handle vandalism and spam the way experienced editors do, you should do three things in addition to reverting the problem edit: determine if that editor has other problem edits, and deal with those as well; post an appropriate warning to the editor; and, in extreme cases, ask an administrator to block the problem editor. Experienced editors also know how to ask that a page be protected if it's repeatedly vandalized by a number of different (typically, anonymous IP) editors.
This chapter shows you the right way to approach what looks like vandalism. For the mechanics of identifying and reverting a problem edit, flip back to Chapter 5: Who did what: Page histories and reverting.
Most vandalism is obvious. But when you encounter something you're not sure about, Wikipedia's guidelines suggest that you assume good faith in assessing the edits of others. (Details at WP:AGF.) That doesn't mean that you should excuse vandalism and spam; it means that when you encounter something that's in a gray area, investigate further, as described in this section. If it isn't clearly vandalism or spam, fix the erroneous edit, and presume it was a mistake.
As a general rule, fix improper edits and remove irrelevant links, but if the editor in question has a history of constructive edits, don't label those edits as vandalism, and don't call the links linkspam unless you find a lot of problem edits. New editors can make honest mistakes.
Some vandals are clever enough to add a semi-plausible edit summary to a vandalizing edit. Still, if there's an edit summary, you should consider that major evidence that you're not looking at vandalism, but rather at a content dispute ( Chapter 10: Resolving content disputes). On the other hand, if you're looking at a questionable edit which also lacks an edit summary, it's appropriate to lean toward treating it as vandalism.
Note that some edit summaries are automatically added by the software, such as the title of the section edited (see the section about reading a page history). The software can also add other summaries if an editor does not enter any edit summary. Many of these automatic summaries highlight obvious vandalism, such as "Blanked the page". Such automatic summaries are prefixed with a left-pointing arrow (←). For judging whether something is vandalism, treat automatic edit summaries as if no edit summary was there, since they indicate that none was entered by the editor.
Before you revert an edit, you should always think about who did that edit. Take the editor's history into account when you're estimating the likelihood that an edit is vandalism. Here are the two extremes:
Suppose you notice an edit where a date has been changed – say, from "1920" to "1921," or the middle name of a person has been changed from "Smith" to "Smithers." Is it vandalism or not? When you check the page history, you see this isn't just a revert to the way the article had been earlier—it's a new change. You need more information.
Ideally, the article would have a citation that included an external link, so that you yourself can verify the information in the article. But if no external link provides an answer, even in the "External links" section, then information about the editor can help you decide what to do. Start by looking at the link to the user talk page. If it's a red link, there's no user talk page, so the user account is almost certainly new. You should then basically revert on principle, because it's more likely that the original information was correct than the change made by an editor who's apparently brand-new to Wikipedia. If the link to the user talk page is blue, follow it. If there are warnings, then again it's likely that the edit you're examining is vandalism.
If the editor in question is registered, not an anonymous IP editor, and there's no evidence that the editor is a vandal, then it's a courtesy to drop a note on the editor's user talk page, saying you've reverted the edit due to lack of an edit summary and lack of a citation, and that the editor should feel free to make the change again if an explanation is provided. Notes like that help inform new, well-intentioned editors about the right way to do things.
If the questionable edit you're examining was done by adding text to an article, not by deletion or changing of information, consider alternatives. You can, for example, add the
Citation needed template (type {{
citation needed|date=April 2024}}
) to the end of a sentence or paragraph that you question, rather than deleting it. You can also edit it a bit to make the language more neutral.
When you revert vandalism and spam, it's critical to leave a clear edit summary. If you're dealing with obvious vandalism by a user account with no apparent history of constructive edits, then rv will suffice. That abbreviation tells experienced editors that you've reverted vandalism; it's fine that it's cryptic because communication with the editor who did the obvious vandalism is unlikely. With less clear cases, your edit summary needs to be lengthier because it may be the start of a dialog with another editor.
For example, if you suspect a subtle form of vandalism like changing a date or name but can't prove it, something like rv edit unsupported by a citation; edit made by a user without history of constructive edits is appropriate. Think of your edit summary as a sort of log entry; even if you're incorrect, you've still started a constructive dialog by explaining yourself.
If another editor has deleted a bunch of text but doesn't offer any explanation in the edit summary, a good edit summary for your reversion would be rv unexplained deletion. This summary explains why you restored the text and invites that editor to add an edit summary next time.
Wikipedia's conflict of interest guideline (shortcut: WP:COI) says that editors generally "are strongly advised not to edit articles where they have a close personal or business connection." But it makes an exception for "non-controversial edits," which include the removal of spam and the reverting of vandalism.
If you find yourself in a conflict of interest situation, the important thing is to make sure that what you're reverting is vandalism, not something else. In particular, Wikipedia's vandalism policy (shortcut: WP:VAND) says that the following are not vandalism: edits that are not neutral in point of view, bold edits that substantially change text, and misinformation added in good faith.
If the problem is something other than vandalism, like inaccurate information, then simply post to the article talk page, citing a source (ideally providing a link) for what you want changed. (Wikipedia's conflict of interest guideline says that you don't have to volunteer that you have a conflict of interest if you don't want to, but it may help here, since other editors may wonder why you don't just fix the article yourself.)
Some vandals hit only one page; some hit many. Spammers typically hit many pages, but sometimes only one (or they're caught early in a spamming spree). A good editor, upon finding one problem edit, looks for others. The place to do so is the editor's User contributions page. After you've identified the problematic edit, and are looking at a history page, you can jump to the contributions page of the problem editor in one of two ways:
At the User contributions page, focus primarily on edits done in the past couple of days. But your first concern should be those edits which have a "top" in bold at the end of the row (see Figure 7-3). If an edit was vandalism or spam, and it has a "top" at the end, that means it has not been reverted.
How you go about reviewing a specific editor's edits is a matter of personal style. Here are some tips:
Although they shouldn't, brand-new editors often do an erroneous edit to an article, then immediately do another edit to repair the damage. This behavior is not considered vandalism, if this is the first time, or the editor hasn't been told to stop doing it, because vandalism requires what Wikipedia calls bad faith. Such edits shouldn't be ignored, but someone who cleans up after themself shouldn't be treated harshly, either.
For such cases, the best thing you can do is post a standard welcome on that editor's user talk page, assuming one isn't there already, to provide them with some useful starting links, plus a gentle suggestion to use the sandbox for playing around. Type the following warning template on the user talk page:
{{ subst:uw-test1|Article}} ~~~~. (That may look odd, but you'll see, once you preview it, it makes sense. You'll find information on these warnings via the shortcut WP:WARN.)
If the editor has already been warned about not editing actual articles, use a stronger warning: use "uw-test2" or "uw-test3" instead of "uw-test1". Finally, if there have been repeated warnings, then treat the matter as pure vandalism.
So, you've found some vandalism or spam, and researched other edits by the same user account to see if there's more. The next, and important, step is to post an appropriate warning on the editor's user talk page.
The primary purpose of a warning about vandalism or spam, perhaps counter-intuitively, is not to get the problem editor to change their ways. (It would be nice if they did so, but troublemakers aren't like to reform themselves just because someone asked nicely.) Rather, when you and other editors post a series of increasingly strong warnings, you're building a documented case for blocking a user account from further disruptive editing. If the warnings lead to the editor changing their ways before blocking is necessary, great—but don't hold your breath.
Start by looking at the warnings that have already been posted on the user talk page, if any. Then take a look at the history tab for the user talk page: the editor might have deleted warnings by other editors.
You'll find a table of warnings at Wikipedia:Template index/User talk namespace (shortcut: WP:WARN). Warnings to editors come in levels 1 through 4:
From the warning table, pick an appropriate warning at the level you've chosen. Picking the appropriate level of warning is an art, not a science. Here are some general guidelines:
Once you've selected an appropriate warning template, posting it is a quick five-step process. (If you're not dealing with a real situation, you can still practice this procedure by posting to your own user talk page. Just don't click "Publish changes". Instead, in the last step, stop after doing the preview.)
1. On Wikipedia:Template index/User talk namespace (shortcut: WP:WARN), copy the text of the template warning to the clipboard (Ctrl+C on Windows; ⌘-C on Mac).
2. On the user talk page where you want to post the warning, click the "+" tab at the top to start a new topic.
3. You're in edit mode, with a new section visible for you to edit.
4. In the subject line, type Warning or something more specific like Warning – your edit to [[Name of article]].
5. In the body of the new topic posting, paste (or type) the template, with {{ subst: at the front and }} at the end, followed by tildes for your signature (for more on signing your comments, see the section about signing comments).
When you post a warning template, always start the template with {{subst:. This code tells the software to use the template page to post the standard wording, and then to lock that wording in place. In other words, when you publish the edit, it pastes the actual text into the page's wikitext in place of the template you typed.
Reasons for including the subst: include the following: When an editor looks at the underlying wikitext, they see the same text as on the page, not something like {{ uw-test1}}, which can confuse new editors. Also, the locked text never changes, even if the wording of the warning template changes in the future, so your warning's intent remains clear. Finally, it's slightly less work for Wikipedia's servers to display the wikitext of a page rather than going to a template page to find and process the template to get that text. If you forget to include the subst:, a bot will usually add it for you.
6. Click "Show preview" to make sure everything worked as expected (see Figure 7-5).
7. If everything looks okay, then click "Publish changes".
If you are warning a user identified by an IP address, it may also be worthwhile to perform a WHOIS lookup on the address ( The WMF has a tool to carry this out). Use the results from this to place a suitable WHOIS template, from the table on this page, on the users talk page. In some circumstances a user realising their ISP, business, or school can be traced, may lead to a cessation of the vandalism.
It's generally not worth posting a warning in these cases:
Wikipedia has a well-known saying: " Don't template the regulars." As discussed above (see the section about considering the source), someone who has a long history of constructive edits isn't likely to have done a vandalizing or spamming edit. If it looks like they did, you should double-check and triple-check before proceeding. And if you do conclude that their edit looks non-constructive and revert it, don't use a warning template to post a message: Write something more personal. (For example, you might post something like I'm not sure I understood {{ diff|Some page|prev|234567890|this edit that you did}}, I reverted it because it looked like a mistake; please let me know if I missed something.)
In cases of vandalism and spam, administrators (there are 861 of them at the English Wikipedia) can take two types of preventive measures unavailable to normal editors—protecting pages and blocking vandals.
If a page is repeatedly vandalized by a changing cast of anonymous IP editors, then temporary semi-protection of the page is probably appropriate. Semi-protection means that registered editors can still edit the page (starting 4 days after they register), but anonymous IP addresses can't. (Anonymous users with suggestions for changes should post them to the article talk page.) It's quite unusual to fully protect a page because of vandalism; full protection is normally done only for cases of major content disputes (see Chapter 10: Resolving content disputes).
In the first sentence of the prior paragraph, two key words are "repeatedly" and "changing." You shouldn't request semi-protection of a page unless there have been at least a half-dozen vandalizing IP edits in the last 24 hours or so. If there are fewer, administrators may feel that it's better to simply manually revert the vandalism. And the IP addresses need to vary or otherwise be unblockable. Otherwise, administrators prefer blocking a few IP addresses.
To request semi-protection, post at Wikipedia:Requests for page protection (shortcut: WP:RFPP).
Note that semi-protection is normally only temporary: The goal is to get vandals to lose interest in the protected page. Anonymous contributions have built a significant percentage of Wikipedia, so the Wikipedia community is very reluctant to close off editing to all IP addresses for an indefinite period, even to only a single page.
Blocking is a preventive action, not a punitive one. If, for example, you find vandalism that's more than a day or two old (different administrators have different thresholds), it's pretty unlikely that your request to block the account will be granted.
An administrator can block an account for any amount of time between a minute and indefinitely. Registered accounts whose only edits have been vandalism are typically blocked indefinitely, but other user accounts usually get an escalating approach. For example, block for a day; if vandalism recurs, block for a week; if it recurs again, block for a month; and only then, if it recurs again, block indefinitely.
In this tutorial, you'll report a fictional vandal, an anonymous user who edited from IP address 127.0.0.1, and who vandalized six articles about an hour ago. You'll go through all the steps of making the report, except that on the final step, after you do a preview, you'll just close the page rather than saving your edit. (Since it's a fictional vandal, you don't want to make a real report.)
Report vandalism only when you think the problem has risen to the level where warnings are no longer appropriate. Generally, that means that either the user has already received a level 4 warning, and continued to vandalize, or that this is a vandal-only registered account, or that the account gives indication of a sophistication of edits well beyond a typical new editor. (Remember: If you decide to post a warning, do not also report the vandalism to administrators for their review.) In this example, IP address 127.0.0.1 has already been blocked, 2 days ago, for 24 hours, for vandalism.
1. Go to Wikipedia:Administrator intervention against vandalism (shortcut: WP:AIV).
2. Scroll down to the section titled "User-reported", and click the "Edit" link on the left of that section title to open the section for editing.
3. In this case, since this is an IP vandal, copy the first of the asterisked rows to the bottom of the section, and then change the characters IP to 127.0.0.1.
4. Replace the words provide a reason (keep it short) with user was blocked for vandalism two days ago; has done it again, and then add the edit summary Reporting 127.0.0.1. Click "Show preview".
5. Close the preview window without saving, so you don't send the administrators off on a wild goose chase.
Postings to the Wikipedia:Administrator intervention against vandalism page are among the most likely to involve edit conflicts, because the volume of vandalism reports is so high. Here's one way to avoid the problem:
I went to the trouble of reporting a vandal who had repeated warnings and kept messing with pages. When I went back to check, the admins hadn't blocked them. What gives?
Most editors don't bother to follow up on their reports at WP:AIV, since the admins who work on these reports are conscientious, and blocking is always a judgment call. Still, if you reported a user or IP address for administrator intervention against vandalism, you may be curious about what happened, or notice later that the user wasn't blocked. (The editor's User contributions page has a link to the block log.)
WP:AIV reports aren't archived, since their sheer volume (many hundreds per day) makes that almost pointless. But you can still usually find out what happened by checking the page history, because most administrators explain in their edit summary why they're removing an entry without blocking an IP address or user. (Change the page history to show 500 entries at a time, or you'll be paging through it for a long, long time.)
If you remove what you consider vandalism, and the same editor puts it back, don't automatically remove it again. Before reverting, you need to decide if this is a content dispute ( Chapter 10: Resolving content disputes) or just a persistent vandal. Here are the factors you should consider:
What if you revert an edit the second time, and the same editor (or another IP address that it appears the same editor has migrated to—say, an IP address that previously had no edits whatsoever) does the edit (or a very similar one) for a third time? Then you want to read Wikipedia:Three-revert rule (shortcut: WP:3RR) very carefully. If you're absolutely sure that any reasonable editor would agree that you're fighting vandalism, go ahead and revert again. But if there's any doubt at all, go to Chapter 10: Resolving content disputes.
Although vandalism and spam are constant aggravations, the ongoing efforts of thousands of editors—like you—do a surprisingly good job of minimizing these problems. This chapter explains in detail what you, a Wikipedia editor, can do in terms of spotting and fixing vandalism and spam.
For Wikipedia, the "encyclopedia that anyone can edit," vandalism—the destruction of content or the addition of useless or malicious content—is a constant, ongoing issue. "Anyone" includes cranks, juveniles (of any age) who don't have anything better to do, and those who hold a grudge against Wikipedia because of past blocks or bans. For readers, obvious vandalism casts doubt on the accuracy of Wikipedia articles. If the vandalism is subtle, readers can be deliberately misinformed. For editors, fighting vandalism reduces the amount of time available to improve articles.
Spam, at Wikipedia, refers to improper external links added to Wikipedia articles, which is why you often see the term linkspam. Spam is a smaller problem than vandalism because most readers of Wikipedia articles don't follow external links. Still, as Wikipedia becomes more widely read, the temptation grows to add links in the hopes that someone will click them, generating traffic for the spamming Web site. (See the box below for more detail on the differences between vandalism and spam.)
Fighting vandalism and spam is a bit like doing detective work: In addition to figuring out who did what ( Chapter 5: Who did what: Page histories and reverting), you investigate the extent of the problem, assess the possible underlying motives of the perpetrator (that affects things like warning levels), and then decide what to do (warn, request a block, and so on). It's important work, and many editors specialize in it.
Vandalism is any addition, removal, or change of content made in a deliberate attempt to compromise Wikipedia's integrity. The most common types of vandalism include the addition of obscenities to pages, page blanking, and the insertion of jokes or nonsense. (For more information, go to WP:VAND.)
Adding external links to an article or user page for the purpose of promoting a Web site or a product is considered spam, and isn't allowed. If an editor adds numerous spam links (to the same external Web site) along with a few acceptable links, the appropriate action by other editors is to remove all links. Over time, non-spamming editors can add back any relevant links that were mass-deleted. (For more information, see WP:SPAM.)
The Wikipedia community has evolved multiple lines of defense against vandalism and, to some extent, spam. They are, roughly in the order of how fast they kick in (bots being the fastest):
When you read a randomly picked Wikipedia article, you rarely see vandalism. That's a testimony to the effectiveness of vandal-fighting, despite evidence that the extent of vandalism is increasing (Figure 7-1).
If you simply revert a vandalizing or spamming edit, and then go about other business, you've missed a major opportunity to find other vandalism and spam by the same editor. Worse, you've made it less likely that other editors will check the edit history of that editor in the future, looking for vandalizing and spam, and if indeed there are such problems, you've given the problem editor more time to continue with destructive editing.
To handle vandalism and spam the way experienced editors do, you should do three things in addition to reverting the problem edit: determine if that editor has other problem edits, and deal with those as well; post an appropriate warning to the editor; and, in extreme cases, ask an administrator to block the problem editor. Experienced editors also know how to ask that a page be protected if it's repeatedly vandalized by a number of different (typically, anonymous IP) editors.
This chapter shows you the right way to approach what looks like vandalism. For the mechanics of identifying and reverting a problem edit, flip back to Chapter 5: Who did what: Page histories and reverting.
Most vandalism is obvious. But when you encounter something you're not sure about, Wikipedia's guidelines suggest that you assume good faith in assessing the edits of others. (Details at WP:AGF.) That doesn't mean that you should excuse vandalism and spam; it means that when you encounter something that's in a gray area, investigate further, as described in this section. If it isn't clearly vandalism or spam, fix the erroneous edit, and presume it was a mistake.
As a general rule, fix improper edits and remove irrelevant links, but if the editor in question has a history of constructive edits, don't label those edits as vandalism, and don't call the links linkspam unless you find a lot of problem edits. New editors can make honest mistakes.
Some vandals are clever enough to add a semi-plausible edit summary to a vandalizing edit. Still, if there's an edit summary, you should consider that major evidence that you're not looking at vandalism, but rather at a content dispute ( Chapter 10: Resolving content disputes). On the other hand, if you're looking at a questionable edit which also lacks an edit summary, it's appropriate to lean toward treating it as vandalism.
Note that some edit summaries are automatically added by the software, such as the title of the section edited (see the section about reading a page history). The software can also add other summaries if an editor does not enter any edit summary. Many of these automatic summaries highlight obvious vandalism, such as "Blanked the page". Such automatic summaries are prefixed with a left-pointing arrow (←). For judging whether something is vandalism, treat automatic edit summaries as if no edit summary was there, since they indicate that none was entered by the editor.
Before you revert an edit, you should always think about who did that edit. Take the editor's history into account when you're estimating the likelihood that an edit is vandalism. Here are the two extremes:
Suppose you notice an edit where a date has been changed – say, from "1920" to "1921," or the middle name of a person has been changed from "Smith" to "Smithers." Is it vandalism or not? When you check the page history, you see this isn't just a revert to the way the article had been earlier—it's a new change. You need more information.
Ideally, the article would have a citation that included an external link, so that you yourself can verify the information in the article. But if no external link provides an answer, even in the "External links" section, then information about the editor can help you decide what to do. Start by looking at the link to the user talk page. If it's a red link, there's no user talk page, so the user account is almost certainly new. You should then basically revert on principle, because it's more likely that the original information was correct than the change made by an editor who's apparently brand-new to Wikipedia. If the link to the user talk page is blue, follow it. If there are warnings, then again it's likely that the edit you're examining is vandalism.
If the editor in question is registered, not an anonymous IP editor, and there's no evidence that the editor is a vandal, then it's a courtesy to drop a note on the editor's user talk page, saying you've reverted the edit due to lack of an edit summary and lack of a citation, and that the editor should feel free to make the change again if an explanation is provided. Notes like that help inform new, well-intentioned editors about the right way to do things.
If the questionable edit you're examining was done by adding text to an article, not by deletion or changing of information, consider alternatives. You can, for example, add the
Citation needed template (type {{
citation needed|date=April 2024}}
) to the end of a sentence or paragraph that you question, rather than deleting it. You can also edit it a bit to make the language more neutral.
When you revert vandalism and spam, it's critical to leave a clear edit summary. If you're dealing with obvious vandalism by a user account with no apparent history of constructive edits, then rv will suffice. That abbreviation tells experienced editors that you've reverted vandalism; it's fine that it's cryptic because communication with the editor who did the obvious vandalism is unlikely. With less clear cases, your edit summary needs to be lengthier because it may be the start of a dialog with another editor.
For example, if you suspect a subtle form of vandalism like changing a date or name but can't prove it, something like rv edit unsupported by a citation; edit made by a user without history of constructive edits is appropriate. Think of your edit summary as a sort of log entry; even if you're incorrect, you've still started a constructive dialog by explaining yourself.
If another editor has deleted a bunch of text but doesn't offer any explanation in the edit summary, a good edit summary for your reversion would be rv unexplained deletion. This summary explains why you restored the text and invites that editor to add an edit summary next time.
Wikipedia's conflict of interest guideline (shortcut: WP:COI) says that editors generally "are strongly advised not to edit articles where they have a close personal or business connection." But it makes an exception for "non-controversial edits," which include the removal of spam and the reverting of vandalism.
If you find yourself in a conflict of interest situation, the important thing is to make sure that what you're reverting is vandalism, not something else. In particular, Wikipedia's vandalism policy (shortcut: WP:VAND) says that the following are not vandalism: edits that are not neutral in point of view, bold edits that substantially change text, and misinformation added in good faith.
If the problem is something other than vandalism, like inaccurate information, then simply post to the article talk page, citing a source (ideally providing a link) for what you want changed. (Wikipedia's conflict of interest guideline says that you don't have to volunteer that you have a conflict of interest if you don't want to, but it may help here, since other editors may wonder why you don't just fix the article yourself.)
Some vandals hit only one page; some hit many. Spammers typically hit many pages, but sometimes only one (or they're caught early in a spamming spree). A good editor, upon finding one problem edit, looks for others. The place to do so is the editor's User contributions page. After you've identified the problematic edit, and are looking at a history page, you can jump to the contributions page of the problem editor in one of two ways:
At the User contributions page, focus primarily on edits done in the past couple of days. But your first concern should be those edits which have a "top" in bold at the end of the row (see Figure 7-3). If an edit was vandalism or spam, and it has a "top" at the end, that means it has not been reverted.
How you go about reviewing a specific editor's edits is a matter of personal style. Here are some tips:
Although they shouldn't, brand-new editors often do an erroneous edit to an article, then immediately do another edit to repair the damage. This behavior is not considered vandalism, if this is the first time, or the editor hasn't been told to stop doing it, because vandalism requires what Wikipedia calls bad faith. Such edits shouldn't be ignored, but someone who cleans up after themself shouldn't be treated harshly, either.
For such cases, the best thing you can do is post a standard welcome on that editor's user talk page, assuming one isn't there already, to provide them with some useful starting links, plus a gentle suggestion to use the sandbox for playing around. Type the following warning template on the user talk page:
{{ subst:uw-test1|Article}} ~~~~. (That may look odd, but you'll see, once you preview it, it makes sense. You'll find information on these warnings via the shortcut WP:WARN.)
If the editor has already been warned about not editing actual articles, use a stronger warning: use "uw-test2" or "uw-test3" instead of "uw-test1". Finally, if there have been repeated warnings, then treat the matter as pure vandalism.
So, you've found some vandalism or spam, and researched other edits by the same user account to see if there's more. The next, and important, step is to post an appropriate warning on the editor's user talk page.
The primary purpose of a warning about vandalism or spam, perhaps counter-intuitively, is not to get the problem editor to change their ways. (It would be nice if they did so, but troublemakers aren't like to reform themselves just because someone asked nicely.) Rather, when you and other editors post a series of increasingly strong warnings, you're building a documented case for blocking a user account from further disruptive editing. If the warnings lead to the editor changing their ways before blocking is necessary, great—but don't hold your breath.
Start by looking at the warnings that have already been posted on the user talk page, if any. Then take a look at the history tab for the user talk page: the editor might have deleted warnings by other editors.
You'll find a table of warnings at Wikipedia:Template index/User talk namespace (shortcut: WP:WARN). Warnings to editors come in levels 1 through 4:
From the warning table, pick an appropriate warning at the level you've chosen. Picking the appropriate level of warning is an art, not a science. Here are some general guidelines:
Once you've selected an appropriate warning template, posting it is a quick five-step process. (If you're not dealing with a real situation, you can still practice this procedure by posting to your own user talk page. Just don't click "Publish changes". Instead, in the last step, stop after doing the preview.)
1. On Wikipedia:Template index/User talk namespace (shortcut: WP:WARN), copy the text of the template warning to the clipboard (Ctrl+C on Windows; ⌘-C on Mac).
2. On the user talk page where you want to post the warning, click the "+" tab at the top to start a new topic.
3. You're in edit mode, with a new section visible for you to edit.
4. In the subject line, type Warning or something more specific like Warning – your edit to [[Name of article]].
5. In the body of the new topic posting, paste (or type) the template, with {{ subst: at the front and }} at the end, followed by tildes for your signature (for more on signing your comments, see the section about signing comments).
When you post a warning template, always start the template with {{subst:. This code tells the software to use the template page to post the standard wording, and then to lock that wording in place. In other words, when you publish the edit, it pastes the actual text into the page's wikitext in place of the template you typed.
Reasons for including the subst: include the following: When an editor looks at the underlying wikitext, they see the same text as on the page, not something like {{ uw-test1}}, which can confuse new editors. Also, the locked text never changes, even if the wording of the warning template changes in the future, so your warning's intent remains clear. Finally, it's slightly less work for Wikipedia's servers to display the wikitext of a page rather than going to a template page to find and process the template to get that text. If you forget to include the subst:, a bot will usually add it for you.
6. Click "Show preview" to make sure everything worked as expected (see Figure 7-5).
7. If everything looks okay, then click "Publish changes".
If you are warning a user identified by an IP address, it may also be worthwhile to perform a WHOIS lookup on the address ( The WMF has a tool to carry this out). Use the results from this to place a suitable WHOIS template, from the table on this page, on the users talk page. In some circumstances a user realising their ISP, business, or school can be traced, may lead to a cessation of the vandalism.
It's generally not worth posting a warning in these cases:
Wikipedia has a well-known saying: " Don't template the regulars." As discussed above (see the section about considering the source), someone who has a long history of constructive edits isn't likely to have done a vandalizing or spamming edit. If it looks like they did, you should double-check and triple-check before proceeding. And if you do conclude that their edit looks non-constructive and revert it, don't use a warning template to post a message: Write something more personal. (For example, you might post something like I'm not sure I understood {{ diff|Some page|prev|234567890|this edit that you did}}, I reverted it because it looked like a mistake; please let me know if I missed something.)
In cases of vandalism and spam, administrators (there are 861 of them at the English Wikipedia) can take two types of preventive measures unavailable to normal editors—protecting pages and blocking vandals.
If a page is repeatedly vandalized by a changing cast of anonymous IP editors, then temporary semi-protection of the page is probably appropriate. Semi-protection means that registered editors can still edit the page (starting 4 days after they register), but anonymous IP addresses can't. (Anonymous users with suggestions for changes should post them to the article talk page.) It's quite unusual to fully protect a page because of vandalism; full protection is normally done only for cases of major content disputes (see Chapter 10: Resolving content disputes).
In the first sentence of the prior paragraph, two key words are "repeatedly" and "changing." You shouldn't request semi-protection of a page unless there have been at least a half-dozen vandalizing IP edits in the last 24 hours or so. If there are fewer, administrators may feel that it's better to simply manually revert the vandalism. And the IP addresses need to vary or otherwise be unblockable. Otherwise, administrators prefer blocking a few IP addresses.
To request semi-protection, post at Wikipedia:Requests for page protection (shortcut: WP:RFPP).
Note that semi-protection is normally only temporary: The goal is to get vandals to lose interest in the protected page. Anonymous contributions have built a significant percentage of Wikipedia, so the Wikipedia community is very reluctant to close off editing to all IP addresses for an indefinite period, even to only a single page.
Blocking is a preventive action, not a punitive one. If, for example, you find vandalism that's more than a day or two old (different administrators have different thresholds), it's pretty unlikely that your request to block the account will be granted.
An administrator can block an account for any amount of time between a minute and indefinitely. Registered accounts whose only edits have been vandalism are typically blocked indefinitely, but other user accounts usually get an escalating approach. For example, block for a day; if vandalism recurs, block for a week; if it recurs again, block for a month; and only then, if it recurs again, block indefinitely.
In this tutorial, you'll report a fictional vandal, an anonymous user who edited from IP address 127.0.0.1, and who vandalized six articles about an hour ago. You'll go through all the steps of making the report, except that on the final step, after you do a preview, you'll just close the page rather than saving your edit. (Since it's a fictional vandal, you don't want to make a real report.)
Report vandalism only when you think the problem has risen to the level where warnings are no longer appropriate. Generally, that means that either the user has already received a level 4 warning, and continued to vandalize, or that this is a vandal-only registered account, or that the account gives indication of a sophistication of edits well beyond a typical new editor. (Remember: If you decide to post a warning, do not also report the vandalism to administrators for their review.) In this example, IP address 127.0.0.1 has already been blocked, 2 days ago, for 24 hours, for vandalism.
1. Go to Wikipedia:Administrator intervention against vandalism (shortcut: WP:AIV).
2. Scroll down to the section titled "User-reported", and click the "Edit" link on the left of that section title to open the section for editing.
3. In this case, since this is an IP vandal, copy the first of the asterisked rows to the bottom of the section, and then change the characters IP to 127.0.0.1.
4. Replace the words provide a reason (keep it short) with user was blocked for vandalism two days ago; has done it again, and then add the edit summary Reporting 127.0.0.1. Click "Show preview".
5. Close the preview window without saving, so you don't send the administrators off on a wild goose chase.
Postings to the Wikipedia:Administrator intervention against vandalism page are among the most likely to involve edit conflicts, because the volume of vandalism reports is so high. Here's one way to avoid the problem:
I went to the trouble of reporting a vandal who had repeated warnings and kept messing with pages. When I went back to check, the admins hadn't blocked them. What gives?
Most editors don't bother to follow up on their reports at WP:AIV, since the admins who work on these reports are conscientious, and blocking is always a judgment call. Still, if you reported a user or IP address for administrator intervention against vandalism, you may be curious about what happened, or notice later that the user wasn't blocked. (The editor's User contributions page has a link to the block log.)
WP:AIV reports aren't archived, since their sheer volume (many hundreds per day) makes that almost pointless. But you can still usually find out what happened by checking the page history, because most administrators explain in their edit summary why they're removing an entry without blocking an IP address or user. (Change the page history to show 500 entries at a time, or you'll be paging through it for a long, long time.)
If you remove what you consider vandalism, and the same editor puts it back, don't automatically remove it again. Before reverting, you need to decide if this is a content dispute ( Chapter 10: Resolving content disputes) or just a persistent vandal. Here are the factors you should consider:
What if you revert an edit the second time, and the same editor (or another IP address that it appears the same editor has migrated to—say, an IP address that previously had no edits whatsoever) does the edit (or a very similar one) for a third time? Then you want to read Wikipedia:Three-revert rule (shortcut: WP:3RR) very carefully. If you're absolutely sure that any reasonable editor would agree that you're fighting vandalism, go ahead and revert again. But if there's any doubt at all, go to Chapter 10: Resolving content disputes.