Wikipedia:Dealing with vandalism

Here's how it works:

First you detect that someone has vandalised a page, for example replacing the entire page with a reference to homosexuality. So you revert the page. Congratulations, you have just successfully dealt with vandalism!

If you're feeling energetic, you can go through other edits made under the same IP address, and check those whether those edits are also vandalous. If they are, revert them as well. Congratulations, you have just successfully dealt with repeated vandalism!

For persistent vandals who vandalise many entries, consider adding them to the vandalism in progress page. In the vast majority of cases this is unnecessary, and the vandals may be dealt with in the normal course of Wikipedia events.

Adding someone to "vandalism in progress"

When you notice what you believe to be an act of vandalism at work, take note of that person's IP number or handle. Edit the vandalism in progress page, adding the person's IP number, and sign it with four tildes (~~~~) to give the date and time.

Then put the person's IP or handle in the Summary field and hit save.

Vandalism appears on Recent Changes, along with the id of the alleged vandal, and other wikipedians can decide whether damage has actually occurred. If there is consensus that an attack was correctly identified, everyone will help repair the damage. When the attack is finished, come back and remove the information you added.

If no attack occurred (e.g. it was just a difference of opinion about what is appropriate content or style, not intentional defacement), then the line will be removed from the vandalism in progress page. We hope cases of mistaken listing will be rare.

Please only use this page for geniune malicious vandalism, and only for a sustained attack. If you make any changes to this page for other reasons, put something like "Not calling a vandalism alert" in the summary box, or mark it as a minor edit

Blocking vandals

Sysops have the ability, and the authorisation, to block the IPs of persistent vandals. These blocks should last for a maximum of one month, in the case of static IPs. In the case of dynamic IPs, the blocks should be as shortlived as possible, to avoid inconveniencing genuine contributors.

If an ex-vandal evades an IP block by obtaining a new IP, and starts making genuine (non-vandalism) contributions to Wikipedia, then they will not be blocked or reverted simply because they used to be a vandal. We do not block vandals to punish them, but to preserve the integrity of Wikipedia. If an ex-vandal has reformed, then our aims are accomplished.

Vandalism should not be confused with:

Vandalism is vandalism: these things are not, though they are sometimes called vandalism. They are therefore treated differently:

• Newbie test: New users that discover the "Edit this page" button want to really know if they can edit any page, so they write something inside just to test it. This is not vandalism! on the contrary, these users should be warmly greeted, and given a reference to the Sandbox where they can keep making their tests (sometimes they will even revert their own changes).

• Extended newbie test: Some users (especially the young ones) want to check out if they can make an article look really stupid, or radically change it to become unreadable. They simply want to test the limits of the wiki, some of them will stop (at some point) when you revert their changes, and will feel embarrassed when you write them a message.

• NPOV violations: The neutral point of view is a difficult policy for many of us to understand, and even Wikipedia veterans occasionally accidentally introduce material which is non-ideal from an NPOV perspective. See NPOV dispute.

• Bold edits: Wikipedians often make sweeping changes to articles in order to improve them - most of us aim to be bold when updating articles. While having large chunks of text you wrote removed, moved to talk, or substantially rewritten can sometimes feel like vandalism, it should not be confused with vandalism.

Types of vandalism

• Childish vandalism: Some vandals spread the textual equivalent of graffiti over pages. They're extremely easy to detect, and are generally reverted in less than a minute.

• Sneaky vandalism: These are the users that think they can outsmart the wiki and put their little comments, misinfo and typos on articles, without anyone noticing. Often this vandalism can be detected by looking at other edits by the same user, but we must be careful to avoid confusing sneaky vandalism with genuine corrections to an article.

• Attention-seeking vandalism: (a type of internet troll). The opposite of sneaky vandalism, they want attention, and will do anything to get it, they will write insults, use offensive usernames, replace articles with jokes etc. just to make you resentfully messege them, and when you do that, they will find that as an excuse to replace your personal page with a story about your mother. So when you recognize this type of attack, try not to feed the troll by flaming him or her - just deal with it calmly and unemotionally - or leave it to someone else to do so if it's making you too angry.

• VandalBot: (or just an AdVandal who puts advertising) Fortunately, real robot attacks have not been seen to-date, but some tedious users may try to make you think they are bots (e.g. "YOU HAVE BEEN TESTPROGGED"), they will attempt to vandalise massive amounts of articles, blanking, or adding commercial links. In this situation, administrator intervention is needed and the IP or complete IP range used by the vandal should be blocked, and all changes reverted systematically.

• Distributed VandalBot attack: Theoretically it is possible that VandalBots will be operated from many different locations in a way that will make it hard to block them (see also DDoS attack). Wikipedia is an open and free project that often appeals to technically knowledgeable people, the question why would any group want to perform an attack like this remains.

Feel free to revise this as you wish

See also

• Talk:Right Back
• Favorite pages of banned users