RECESSIM:Handling vandalism

This page is for administrators (sysops). It explains how to spot, undo and prevent vandalism on RECESSIM. Almost everything on a wiki is reversible: every edit is kept in page history, and deleted pages can be restored.

1. Spotting problems

• Special:RecentChanges: every edit. Edits that nobody has reviewed yet show a red ! ("unpatrolled"). Click diff, then Mark as patrolled once you're happy with an edit.
• Tags: five automatic filters tag suspicious edits in Recent Changes. They never block anyone.
  • av-blanking: a page was emptied (over 500 bytes down to under 50).
  • av-large-removal: more than 5 KB removed in one edit.
  • av-link-dump: more than 10 external links added in one edit.
  • av-repeated-chars: keyboard mashing (one letter g–z repeated 30+ times; hex dumps are ignored).
  • av-page-move: any page move (moves are rare here).
• Special:AbuseLog: the full list of filter hits, with the exact edit details. Manage the filters at Special:AbuseFilter.
• Keep an eye on changes: watch important pages (star icon), or subscribe to the Recent Changes feed (Atom link in the sidebar of Special:RecentChanges).

2. Undoing damage

• One bad edit: open the page's History and click undo on that edit.
• Several bad edits in a row by one user: click rollback in the history or on Recent Changes. It reverts all of that user's consecutive latest edits in one click. Sysops and members of the trusted group have rollback.
• Restore an older good version: in History, open the good revision, click Edit, and save it with a summary such as "Restore version of <date>".
• A moved page: move it back (the Move tab), and delete the leftover redirect if needed.
• Lots of junk pages from one account: Special:Nuke lists every page that account created, so you can mass-delete them.
• Deleted by mistake: Special:Undelete.

3. Stopping it

• Block the account: Special:Block. Use a short block for a first offence and indefinite for obvious vandal-only accounts. Leave "Autoblock" ticked so the IP address is blocked too.
• Remove editing rights: Special:UserRights. Take the account out of writer; sysops can add or remove writer and trusted.
• Ban evasion or sockpuppets: Special:CheckUser shows which accounts share IP addresses (CheckUser right only).
• Protect a page under attack: the Protect tab (admins only, set an expiry). High-use templates are already permanently protected.

4. Giving people the right level of access

• writer: can edit and create pages. Granted after someone introduces themselves on Discord.
• trusted: writer plus rollback, and their own edits are marked as reviewed automatically. Give this to reliable regular editors.
• sysop: everything above plus delete, block, protect and filters. Keep this group small.
• Writer rights are removed from accounts that have been inactive for over 12 months. Anyone can ask on Discord to have them restored.

5. Worst case: restoring from backup

If the wiki is badly damaged (for example a compromised admin account, mass deletion, or database problems), the server makes a full backup every Sunday (database, uploaded files, settings). A copy is pulled to off-site storage.

• On the server, backups are in /var/backups/wiki/ (the newest two, with latest pointing at the most recent). Each one contains a README.txt with step-by-step restore instructions.
• A restore is a server-level job: contact Hash. Undoing edits through History (above) is almost always the better option.