In case anyone else out there is as clueless as I was, I’ll use bold letters, since this is important: Apache doesn’t read /etc/hosts.deny. The file is there for utilities using tcpwrappers, and is great for banning connections to, say, ssh. Hosts in /etc/hosts.deny can’t connect to ssh. But Apache doesn’t use tcpwrappers, and therefore isn’t aware of /etc/hosts.deny.

I actually didn’t spot this for a while, until I noticed a few hosts who continued to show up on the list of IPs spamming in the past 72 hours, even though they’d been in /etc/hosts.deny for upwards of a week. Doh!

So I’m now using iptables to block them, which is more of a system-wide firewall. (Although I’m currently only blocking them from port 80.) It won’t “kill spam dead,” of course, but it’ll cut off serial spammers. I’m getting (and automatically rejecting) about 200 spams a day, so I’m hoping this will make a big dent in it.

I also tweaked the statistics page, although it’s getting kind of terse to make it all fit. The “Mod.” column shows the number of comments stuck in moderation. “Drafts” refers to the number of posts saved as drafts, but doesn’t look at pages.

Oh: post things! 5/6 of the posts right now are mine.

When I mentioned that I updated the themes, I didn’t count right. There are actually just shy of 200 themes. All but a few have been tested. And I tweaked the code on the themes page to let you quickly jump to a letter of the alphabet to make it easier to navigate.

I’ve done several small, behind-the-scenes things again. Only one should be visible: I realized that, when I removed the crazy moving tile background a few days ago, I missed the one in the header. (I remarked that it underscored the need to test in IE, not just Firefox. Ironically, had I actually taken my own advice, I would have realized that I didn’t get them all!)

blogs.n1zyy.com now loads the ‘new’ main page. It’s identical to forwarding you to /main2, but the webserver takes care of it instead, making things much cleaner. If you’re hitting :81/main2, it’s just as good. It’s the exact same thing, just served under a different name. No need to update anything, except to save keystrokes.

A third little thing I did was to delete all spam posts older than three days. I don’t like to delete them immediately so that I can notice trends and add blocks as needed, but it’s ludicrous to have spam from weeks ago. I’ve also found that some small tweaks I did were very effective: I (successfully!) use a little mod_rewrite rule I found to block people from posting comments if their referrer isn’t set to something on the server. This is the case with most spammers, since they never actually get the page. It won’t stop everything, but it stops a surprising amount. (I’ve actually written a nice PHP frontend for the script to purge old spam.)

I installed a whole package of themes. There are now too many themes to count. If a new theme falls into the latter half of the alphabet, it hasn’t been tested, because I lost interest somewhere around K. Let me know if you change themes and find a broken one.