Wikipedia:Vandalism

On Wikipedia, vandalism has a very specific meaning: editing (or other behavior) deliberately intended to obstruct or defeat the project's purpose, which is to create a free encyclopedia, in a variety of languages, presenting the sum of all human knowledge.

The malicious removal of encyclopedic content, or the changing of such content beyond all recognition, without any regard to our core content policies of neutral point of view (which does not mean no point of view), verifiability and no original research, is a deliberate attempt to damage Wikipedia. There are, of course, more juvenile forms of vandalism, such as adding irrelevant obscenities or crude humor to a page, illegitimately blanking pages, and inserting obvious nonsense into a page. Abusive creation or usage of user accounts and IP addresses may also constitute vandalism.

Vandalism is prohibited. While editors are encouraged to warn and educate vandals, warnings are by no means a prerequisite for blocking a vandal (although administrators usually block only when multiple warnings have been issued).

Even if misguided, willfully against consensus, or disruptive, any good-faith effort to improve the encyclopedia is not vandalism. For example, edit warring over how exactly to present encyclopedic content is not vandalism. Careful consideration may be required to differentiate between edits that are beneficial, edits that are detrimental but well-intentioned, and edits that are vandalism. If it is clear that an editor is intending to improve Wikipedia, their edits are not vandalism, even if they violate some core policy of Wikipedia. Mislabeling good-faith edits "vandalism" can be harmful, as it makes users less likely to respond to corrective advice or to engage collaboratively during a disagreement. For that reason, avoid using the term "vandalism" unless it is clear the user means to harm Wikipedia; this is even true when warning a user with a user warning template. Choose the template that most closely matches the behavior you are trying to correct.

Upon discovering vandalism, revert such edits, using the undo function or an anti-vandalism tool. Once the vandalism is undone, warn the vandalizing editor. Notify administrators at the vandalism noticeboard of editors who continue to vandalize after multiple warnings, and administrators should intervene to preserve content and prevent further disruption by blocking such editors. Users whose main or sole purpose is clearly vandalism may be blocked indefinitely without warning.

Even in Rome itself, the City of the Popes, the vandalism of the ignorant wrought dreadful havoc.

Rev. James MacCaffrey,

History of the Catholic Church From the Renaissance to the French Revolution

In all the three methods above, examples of suspicious edits are those performed by IP addresses, red linked, or obviously improvised usernames. A good way to start is to click on every edit in watchlists, histories etc. with the least suspicion of being vandalism. Increased experience will probably give a sense of which edit descriptions are worth to check further and which may likely be ignored. Some descriptions like "Fixed typo" may be vandalism as that is one of the default edit summaries. IP editors should not be approached with the assumption that they are vandals. Although many vandals do vandalize without registering an account, there are many IP editors who are great contributors to Wikipedia. Always read the actual changes made and judge on that, rather than who made the changes or what was entered in the edit summary.

If you see vandalism in an article, the simplest thing to do is just to remove or undo it, but sometimes vandalism takes place on top of older, undetected vandalism. With undetected vandalism, editors may make edits without realizing the vandalism occurred. This can make it harder to detect and delete the vandalism, which is now hidden among other edits. Sometimes bots try to fix collateral damage and accidentally make things worse. Check the page history to make sure you're reverting to a "clean" version of the page. Alternatively, if you can't tell where the best place is, take your best guess and leave a note on the article's talk page so that someone more familiar with the page can address the issue—or you can manually remove the vandalism without reverting it.

If you see vandalism on a list of changes (such as your watchlist), then revert it immediately. You may use the "undo" button (and the automatic edit summary it generates), and mark the change as minor. It may be helpful to check the page history to determine whether other recent edits by the same or other editors also represent vandalism. Repair all vandalism you can identify.

To make vandalism reverts easier you can ask for the rollback feature to be enabled for your registered Wikipedia account. This feature is only for reverting vandalism and other obvious disruption, and lets you revert several recent edits with a single click. See Wikipedia:Requests for permissions.

If you see that a user has added vandalism you may also check the user's other contributions (click "User contributions" on the left sidebar of the screen). If most or all of these are obvious vandalism you may report the user immediately at , though even in this case you may consider issuing a warning first, unless there is an urgent need to block the user. Otherwise, you can leave an appropriate warning message on the user's talk page. Remember that any editor may freely remove messages from their own talk page, so they might appear only in the talk history. If a user continues to cause disruption after being warned, report them at . An administrator will then decide whether to block the user.

For relatively inexperienced Wikipedians, use these simple steps to quickly respond to what you consider vandalism. This is essentially an abridged version of Wikipedia:Vandalism.

If no vandalizing edits appear in the page's edit history, or the vandalism obscures the page tabs so you can't easily access the history or edit the page, it is probably template or cascading style sheets vandalism. These are often not difficult to fix, but can be confusing.

To access the page history or edit the page when the "View history" or "Edit" tabs are inaccessible, use Wikipedia keyboard shortcuts. You can also access the history through a vandalism patrolling tool if you're using one, or from your watchlist if you are watching the page), or from your user contributions if you have edited the page. Or, enter the URL manually into the address bar of your browser: it will take the form https://en.wikipedia.org/wiki/Name_of_article?action=edit or https://en.wikipedia.org/wiki/Name_of_article?action=history.

Images are occasionally used for vandalism, such as by placing shock or explicit images where they should not be. When an image has been created exclusively for vandalism, it can be requested for speedy deletion: under criterion G3 if hosted on Wikipedia or as vandalism if hosted on Commons (a file repository for Wikimedia Foundation projects). When an image is used for vandalism due to its explicit nature but has legitimate encyclopedic uses (Wikipedia is not censored) or is hosted on Commons and has legitimate uses on other projects, it can be requested for being added to the bad image list, which precludes its addition on any page except those specified.

The purpose of warning a user who has vandalized is to inform the user that the user's conduct is abusive and prohibited, and seek the user's compliance. Not all that appears to be vandalism is in bad faith, and a warning can politely advise and correct users unaware of the nature of their actions. A warning may even dissuade a user acting in bad faith from continuing, particularly as the warnings escalate and the user is informed of the consequences of continuing.

Warning a user for vandalism is generally a prerequisite to administrator intervention. Because of this, users should be warned for each and every instance of vandalism.

A list of user warning templates, with descriptions and instructions for their use, is at Wikipedia:Template messages/User talk namespace. In addition to a series of user warning templates for vandalism, there are series for specific types of vandalism. Use the most specific user warning template for the conduct. The existence of these templates is intended as a convenience, and their use is not required. A specifically tailored note, written personally and directly addressing the problematic behavior is equally as acceptable as a form of warning, and in many cases, will often result in better engagement with the user in question.

Assume good faith (such as that the user is simply unaware of the policies and guidelines) unless it is clear that the user is deliberately harming Wikipedia from the outset, such as the use of abusive, vulgar, or juvenile vandalism.

If you do choose to use warning templates, please choose templates that are appropriate to the type and level of problem in question. If edits are questionable, but not clearly vandalism, consider using lower-level templates (level 1 or 2) and wait for a few further contributions to see if the other editor responds or changes their behavior. If the behavior continues, or if it is clear the edits are in bad faith from the outset, the use of a higher-level template (level 3 or 4) may be appropriate. If, after receiving multiple warnings, the behavior persists past the point where good faith can be extended, or it becomes clear that the user has had the opportunity to notice they have been warned, and they still persist with the problematic behavior, consider reporting them to the Vandalism noticeboard.

Response from administrators at the vandalism noticeboard varies depending on the type of vandalism and the specifics of the report. Keep in mind:

If you're trying to determine whether a set of IP addresses involved in vandalism are related, a command-line WHOIS query will generally list this information, or can be shown using the DNS name server asn.routeviews.org reverse IP look-up to find the CIDR and ASN for a set of IP addresses. This can be done using IP lookup tools.

A WHOIS query will typically return NetRange, CIDR, NetName, NetHandle, and OriginAS, all of which identify specific network spaces. Data and labeling vary considerably by WHOIS registrar.

The Routeviews data is far more uniformly structured and returns ASN and CIDR as a reverse-lookup TXT query result. It is more useful and faster than WHOIS when checking multiple IP addresses and can be scripted or automated.

CIDR identifies a set of related addresses ("network space") and ASN identifies an Autonomous System—that is, a single administrative entity with control over multiple (and often very many) addresses. Some (though not all) abuse from multiple sources does come from such unified spaces—possibly corresponding to a set of hosts within a single facility.

Abuse originating in a short period of time from different IP addresses within the same CIDR or ASN may indicate a dedicated non-distributed attack, as opposed to a distributed denial of service attack.

It's possible that a user's source location is being masked by routing traffic through a Proxy server, VPN or the Tor network. Such addresses typically serve many, not just one, person, and though they can be valid present challenges when used for abuse.

A proxy VPN is not necessarily detectable, but commercial services may be indicated by the hostname when resolving an IP address.

Users of the Tor anonymity network will show the IP address of a Tor "exit node". Lists of known Tor exit nodes are available from the Tor Project's .

Vandalism on Wikipedia usually falls into one or more of these categories:

Creating accounts with usernames that contain deliberately offensive or disruptive terms is considered vandalism, whether the account is used or not. For Wikipedia's policy on what is considered inappropriate for a username, see Wikipedia:Username policy. See also Wikipedia:Sock puppetry.

Removing encyclopedic content without any reason, or replacing such content with nonsense. Content removal is not considered to be vandalism when the reason for the removal of the content is readily apparent by examination of the content itself, or where a non-frivolous explanation for the removal of apparently legitimate content is provided, linked to, or referenced in an edit summary.

Uploading or using material on Wikipedia in ways which violate Wikipedia's copyright policies after having been warned is vandalism. Because users may be unaware that the information is copyrighted, or of Wikipedia policies on how such material may and may not be used, such action becomes vandalism only if it continues after the copyrighted nature of the material and relevant policy restricting its use have been communicated to the user.

Making offensive edit summaries in an attempt to leave a mark that cannot be easily expunged from the record (edit summaries cannot simply be "reverted" and require administrative action if they have to be removed from a page's history). Often combined with malicious account creation.

Changing the formatting of a page unreasonably and maliciously. But many times, editors might just make an unintended mistake or are testing how the wikicode works. Sometimes it might be a bug in the Wikipedia software. Some changes to the format are not vandalism, but rather either good faith edits of editors who don't know the guidelines or simply a different opinion on how the format should look, in which case it is just a disputed edit.

Any form of vandalism that makes use of embedded text, which is not visible to the final rendering of the article but visible during editing. This includes link vandalism, or placing malicious, offensive, or otherwise disruptive or irrelevant messages or spam in hidden comments for editors to see.

Deliberately adding falsities to articles, particularly to biographies of living people, with hoax information is considered vandalism.

Uploading shock images, inappropriately placing explicit images on pages, or simply using any image in a way that is disruptive. Please note though that and that explicit images may be uploaded and/or placed on pages for legitimate reasons (that is, if they have encyclopedic value).

Adding or changing internal or external links on a page to disruptive, irrelevant, or inappropriate targets while disguising them with mislabeling.

Creating new pages with the sole intent of malicious behavior. It also includes personal attack pages (articles written to disparage the subject), hoaxes and other intentionally inaccurate pages. There are many other types of pages that merit deletion, even speedy deletion, but which are not vandalism. New users sometimes create test pages containing nonsense or even autobiographies, and doing so is not vandalism; such pages can also be moved to become their sandbox or userpage. Pages on non-notable topics are not vandalism. Blatant advertising pages, and blatant POV pushes, are not vandalism, but frequently happen and often lead to editors being blocked. It's important that people creating inappropriate pages be given appropriate communication; even if they aren't willing to edit within our rules, they are more likely to go away quietly if they understand why their page has been deleted.

Adding very large (measured by the number of bytes) amounts of bad-faith content to a page so as to make the page's load time abnormally long or even make the page impossible to load on some computers without the browser or machine crashing. Adding large amounts of good-faith content is not vandalism, though prior to doing so, one should consider if splitting a long page may be appropriate (see Wikipedia:Article size).

Changing the names of pages to disruptive, irrelevant, or otherwise inappropriate names. Only autoconfirmed or confirmed users can move pages.

Redirecting or changing the target of redirect pages to other pages that are vandalism, nonsense, promotional, non-existent pages, or attack pages. This also applies when a redirect or its title is created only to disparage its subject. Pages that redirect to non-existent or deleted pages are also applied with G8.

Reverting edits to the latest revisions that are nonsense, promotional, personal attacks, and/or harrassment.

Adding profanity, graffiti, or patent nonsense to pages; creating nonsensical and obviously unencyclopedic pages, etc. This is one of the most common forms of vandalism. However, the addition of random characters to pages is often characteristic of an editing test and, though impermissible, may not be malicious.

Vandalism that is harder to spot, or that otherwise circumvents detection, including adding plausible misinformation to articles (such as minor alteration of facts or additions of plausible-sounding hoaxes), hiding vandalism (such as by making two bad edits and reverting only one), simultaneously using multiple accounts or IP addresses to vandalize, abuse of maintenance and deletion templates, or reverting legitimate edits with the intent of hindering the improvement of pages. Impersonating other users by signing an edit with a different username or IP address also constitutes sneaky vandalism, but take care not to confuse this with appropriately correcting an unsigned edit made by another user. Some vandals even follow their vandalism with an edit that states "Rv vandalism" in the edit summary in order to give the appearance the vandalism was reverted.

Adding or continuing to add spam external links is vandalism if the activity continues after a warning. A spam external link is one added to a page mainly for the purpose of promoting a website, product or a user's interests rather than to improve the page editorially.

Illegitimately removing or editing other users' comments, especially in closed discussions, or adding offensive comments. However, it is acceptable to blank comments constituting vandalism, internal spam, or harassment or a personal attack. It is also acceptable to identify an unsigned comment. Users are also permitted to remove comments from their own user talk pages. A policy of prohibiting users from removing warnings from their own talk pages was considered and rejected on the grounds that it would create more issues than it would solve.

Modifying the wiki language or text of a template in a harmful or disruptive manner. This is especially serious, because it will negatively impact the appearance of multiple pages. Some templates appear on hundreds or thousands of pages, so they are permanently protected from editing to prevent vandalism.

Unwelcome, illegitimate edits to another person's user page may be considered vandalism. User pages are regarded as within the control of their respective users and generally should not be edited without the permission of the user to whom they belong. See WP:UP#OWN. This is why there is an . Related to this is Wikipedia:No personal attacks.

A script or "robot" that attempts to vandalize or add spam to a mass of pages.

Although at times the following situations may be referred to colloquially as "vandalism", they are not usually considered vandalism within the context of Wikipedia. However, each case should be treated independently, taking into consideration whether or not the actions violate Wikipedia policies and guidelines. If an editor treats situations which are not clearly vandalism as such, .

it may harm the encyclopedia by alienating or driving away potential editors

Bold edits, though they may precede consensus or be inconsistent with prior consensus, are not vandalism unless other aspects of the edits identify them as vandalism. The Wikipedia community encourages users to be bold and acknowledges the role of bold edits in reaching consensus.

Uploading or using material on Wikipedia in violation of Wikipedia's copyright policies is prohibited, but is not vandalism unless the user does so maliciously or fails to heed warnings. It is at least as serious an issue as vandalism and persistent offenders will ultimately get blocked, but it is well worth spending time communicating clearly with those who add copyvio as they are far more likely to reform than vandals or spammers.

Some users cannot come to an agreement with others who are willing to talk to them about an editing issue, and repeatedly make changes against consensus. Edit warring is not vandalism and should not be dealt with as such. Dispute resolution may help. See also: Tendentious editing

Starting a deletion process in bad faith is disruptive editing, but is not vandalism. However, misusing deletion template messages with no intention to start a deletion process is vandalism by abuse of tags.

In short, all vandalism is disruptive editing, but not all disruptive editing is vandalism.

The edit summary is important in that it helps other editors understand the purpose of your edit. Though its use is not required, it is strongly recommended, even for minor edits, and is considered proper Wikipedia etiquette. Even a brief edit summary is better than none. However, not leaving edit summaries is not considered vandalism.

Personal attacks and harassment are not allowed. While some harassment is also vandalism, such as user page vandalism, or inserting a personal attack into an article, harassment in itself is not vandalism and should be handled differently.

Inexperienced users are often unfamiliar with Wikipedia's formatting and grammatical standards, such as how to create internal and/or external links or which words should be bolded or italicized, etc. Rather than label such users as vandals, just explain to them what the standard style would be for the issue at hand, perhaps pointing them towards the documentation at How to edit a page, and the like.

Some users are not familiar with Wikipedia's purpose or policies and may start editing it as if it were a different medium—such as a forum or blog—in a way that it appears as unproductive editing or borderline vandalism to experienced users. Although such edits can usually be reverted, it should not be treated as vandalism.

A user who, in good faith, adds content to an article that is factually inaccurate but in the belief that it is accurate is trying to contribute to and improve Wikipedia, not vandalize it. If you believe inaccurate information has been added to an article in good faith, remove it once you are certain it is inaccurate, or discuss its factuality with the user who has added it.

The neutral point of view policy is difficult for many of us to understand. Even Wikipedia veterans occasionally introduce material which is not ideal from an NPOV perspective. Indeed, we are all affected to a greater extent than we estimate by our beliefs. Though the material added may be inappropriate, it is not vandalism in itself.

While intentionally adding nonsense to a page is a form of vandalism, sometimes honest editors may not have expressed themselves correctly (e.g. there may be an error in the syntax, particularly for Wikipedians who use English as a second language). Also, connection errors, browser extensions, or edit conflicts can unintentionally produce the appearance of nonsense or malicious edits. In either case, assume good faith.

Editors are encouraged to be bold. However, making edits to Wikipedia policies and guidelines pages, such as this one, does require some knowledge of the consensus on the issues. If people misjudge consensus, it would not be considered vandalism; rather, it would be an opportunity to discuss the matter with them, and help them understand the consensus.

Even factually correct material may not belong on Wikipedia, and removing such content when it is inconsistent with Wikipedia's content policies is not vandalism.

Contentious material about living persons that is unsourced or poorly sourced—whether the material is negative, positive, neutral, or just questionable—should be removed immediately and without waiting for discussion, per Wikipedia:Biographies of living persons.

Make sure that the removed content is consistent with Wikipedia's standards before restoring it or treating its removal as vandalism.