I'm building an online store that has many features and functions.

Whenever a user interacts with the site a notification is shown.

These notifications should give the user a response to his action and tell him whether the action was successful or not and also if it wasn't successful tell him what went wrong.

I also considered and implemented control functions that check if the user tries to harm the application, other users or the database. If this is the case I would like to give the user a notification that shows him that I do know what he's doing and leave him with the feeling that he should rather stop now because "we see and know every step he takes".


  • Contact Form: The user has to fill in his information such as his email address, full name and a message,

    • if he doesn't fill in a certain field of the form the notification "please fill in your [name of the empty field]"
    • if the user leaves all the fields empty and just hits the submit button the notification says "please don't send us any empty contact forms"
  • Feedback Form: The user has to write a message, email address & name are optional

    • if he doesn't fill in the message field, he'll get the notification "please write a message"
    • if he fills in the email field with an invalid email address (e.g. asdf) the notification says "Either give us a real email address or just leave the field empty"
  • Deleting profile information: The user can save information about himself. He's able to edit and delete his profile

    • if the user tries to delete a profile that does not belong to him the notification says "you can't delete other users' profiles, don't try this again!"
  • etc. ...

I like the nature of these notification messages but am not sure whether they are appropriate and useful, especially if for any reason a user that hasn't really tried to harm the system gets to read a rather impolite message.

Do you consider such notification messages useful?

What do you think could be problems I have to face if I use this kind of notification messages?

What would be a good alternative to such notification messages?


First: Thank you for your time, thoughts and help!

I'd like to add, that the given examples are by no means all notification messages/places where notifications occur. I do know, that (as msparer and Lego Stormtroopers have pointed out) the described behaviour is not actually trolling. Still there are many other functions where trolls could have a little fling (chat, product review, support, etc.).

I fully agree with what Racheet said, that there is no actual benefit in blaming the user, especially if someone accidentally triggers a notification message that was designed for malicious users.

I also absolutely love how the_lotus handles trolls and will definitely create and implement something similar!

  • 21
    It seems didactic to me and I fully agree with Racheet: there is absolutely no upside for either the user nor the owner of the website. It even may provoke malicious users to go through greater lengths breaking your site. But why do you want to do this? Because, although your method doesn't sound like a good idea, the reason behind it may very well be legitimate.
    – Ruudt
    Aug 6, 2014 at 12:00
  • 40
    Don't feed the Troll, never :)
    – Apolo
    Aug 6, 2014 at 14:24
  • 24
    In my systems, if I can detect that someone is actually trolling I let them in their own little world (ex: Pretend the form was submitted). Some of my system have an internal reputation system for IP and Users for admin to look at. I've seen some forum actually letting the user post their message but only them can see it, so to them, it looks like no one is giving them attention.
    – the_lotus
    Aug 6, 2014 at 15:11
  • 13
    I wonder why it is even possible to request an action to another user if it can only apply to the current user, i.e. why you have a URL format of /{username}/delete instead of /deleteme.
    – nmclean
    Aug 6, 2014 at 15:55
  • 26
    None of those actions sound like trolling. That's either a user not knowing what they are doing or a malicious hacker. Trolling would be filling the content form with My Little Pony Fanfic or ASCII art of well... use your imagination.
    – user31914
    Aug 6, 2014 at 23:33

7 Answers 7


Don't write error messages blaming the user. There is no actual benefit to you from doing this.

In the event that someone accidentally triggers these error messages, you damage your relationship with them. Even if you do manage to tell a single malicious user that you know they're malicious, it isn't going to make them like you any better.

All you're doing is damaging your relationships with honest users of your site, in order to better damage your relationships with malicious users of your site.

There are no upsides for either you, or your users.

  • 53
    "don't feed the troll". Your best chance is to bore him: if you do something he finds hilarious he will keep on trolling. It is not like you have any chance to scare him away anyway (source: my experience as a troll)
    – pqnet
    Aug 6, 2014 at 12:32
  • 8
    I agree. It's awkward and rude if these messages are triggered by accident, it's an empty threat ("don't try it again" or what?) and it doesn't contribute to the application's secuirty (anyone seriously aiming to harm your application won't be deterred or impressed by the existence of a regex that validates the form of an email address).
    – T. C.
    Aug 6, 2014 at 12:33
  • 11
    "All you're doing is damaging your relationships with honest users of your site, in order to better damage your relationships with malicious users of your site." Excellent.
    – ABMagil
    Aug 6, 2014 at 13:36
  • 1
    +1, came here to say this. Not to mention that any real malicious user that's targeting your site is not going care about what the error message says.
    – grover5
    Aug 6, 2014 at 13:46
  • 2
    You should add to this that it's just better to give generic messages. If the user manually edits a URL to have an ID that they don't have access to, just give them a 404 page because to that user, that page does not exist. There's no need to let them know that the page does exist, just not for them.
    – nzifnab
    Aug 8, 2014 at 16:31

The first thing you have to find out is, if it's really a troll. Your Contact Form and Feedback Form examples have nothing to do with trolls. It's just a feedback message. The third example sounds like a hacker or script kiddie who's trying something, also no troll.

So for the first two examples, choose a error message that tells what to do, but does not blame the user. For the third one, I'd suggest to silently redirect to another page, as tampering with URLs doesn't sound like a normal use case and doesn't need dedicated user feedback.

But as your question is about trolls, some advice about trolls (I deal with them a lot).

Recognising trolls

First of all it's important to find out if it's really a troll you're dealing with. E.g. a comment that looks suspicious and/or malicious could also be a new user that doesn't know how to use the system.

"Most trolls are sad people, living their lonely lives vicariously through those they see as strong and successful"

Disrupting stable systems and upsetting people gives them the illusion of power. So pay attention to users who insult without reason or deliberately post wrong/insulting comments.

If you're not sure if you are dealing with a troll, it is OK to ask a user about a strange comment/contribution. But always be polite! If you receive a rude answer, then ignore it and don't respond to it by any means!

What NOT to do

Don't feed the troll!

The worst thing you can do is to tell trolls what you really think about them. That's like punishing a masochist. It'll just motivate a troll to carry on trolling. A troll's sole intention is to get attention and to upset other people. So no matter how angry you are with a troll (and believe me, I'd send big guys with baseball bats to their homes if I could) – just don't show it to them.

What to do

If there's a troll, the best thing that can happen – apart from just going away – is that they always use the same user name. This allows you to keep an eye on them. So it wouldn't be wise to block the user name, as this is exactly what they're aiming for. As mentioned, they're craving for attention. So ignoring and deleting the contributions, best automatically after a given time is the best option.

Further reading:


First of all, as I stated in my comment, none of those actions are "trolling". If the are malicious they are "hacking" or "cracking" or what ever verb you wish to use there - but not trolling.

Treat hackers like everyone else, give them the same information you would share with anyone. Looking at your examples:

Contact Form:

  • If the user leaves everything empty, politely inform them of this: We value your feedback, but you've left the feedback field empty. Please add some feedback and we can work on improving our service.

Feedback Form: Your responses look fine here.

Deleting profile information (or doing any action that requires additional permissions):

  • "I'm sorry your account doesn't have the permissions to [delete another users account]. Please contact an administrator if you think your account needs additional privileges.

Its important to note here we have said two things:

  1. We have a privileges and permissions system set up, so you need to meet specific requirements to perform specific actions - this should make a hacker rethink their target
  2. You (the user) isn't at fault, your account may not be set up correctly, but you may actually need to perform this action and we have given you a solution to this.

At the end of the day, consider crackers or trolls like every other user, and give them no more information than you would give anyone else. Every additional piece of information you give a hacker is a piece of information they didn't have before.

As they say kill them with kindness, there are only so many times a troll will see "I'm afraid I can't let you do that Dave" before they give up.

  • 7
    Deleting profile information: "I'm sorry you entered your account number incorrectly". That's correct for the genuine user making a mistake, and doesn't give a hacker additional information.
    – gnasher729
    Aug 7, 2014 at 9:58

For your responses in your user interface, assume that the user is a genuine user who is making a mistake. They are the only targets for your user interface. For security reason, make sure that you don't give any hints to malicious users how to get around security. For example, say things like "your username or password is incorrect" and not "your password is incorrect" because you don't want to give a hacker the information that they guessed a username correctly.

Your company doesn't make money from trolls and hackers, so you shouldn't waste your time designing a user interface for them. And every time you mistake a genuine user for a hacker or troll, you have the opportunity to lose a customer, or worse annoy them so much that they warn people off your company. It's even possible your response makes them think your site is hacked and dangerous.

You gave an example of trying to delete the account of a different user. I have some big security concerns here. Of course a user can enter data that should refer to his account incorrectly (and you can tell them). It should be absolutely impossible to enter data referring to another account by accident. If a user can do that then it seems your site has a problem (not in the user interface design, but elsewhere).

  • no user can delete any accounts except their own. users can only delete informational profiles (e.g. body measurements). the id for the profile that should be deleted is submitted via URL, therefore a malicious user could try to manually enter a URL with a random id. if you still have (big) security concerns I would like to elaborate on this topic.
    – qsi
    Aug 7, 2014 at 10:36

To answer the question in the title: don't. Treat data trolling (invalid data input) for what it is: invalid data input.

The simplest way to keep people from 'trolling'? Don't allow users to break things. If you do, users will play around when they really shouldn't.

For the form UI: don't allow the user to click submit (grey it out) unless all forms are filled. Make it clear that all forms must be filled (make them red..?).

For the backend: make sure requests are authorized, sanitized, and necessary. For requests to /users/{username}/delete, make sure that {username} == the username attached to the user's session cookie. Make a very generic error message (as mentioned in Francisco's answer, where he uses boring/long error messages to frustrate trolls. To tie into the form issue, make the server sanitize requests. If somebody sends an empty form (or invalid data), throw an error.

  • 1
    Francisco has deleted his answer, maybe you could supply an example yourself?
    – iFreilicht
    Aug 11, 2014 at 9:14
  • Fortunately, Google cached his answer. I added a brief description and changed the link to the cached version. Hope it helps!
    – Luke Adams
    Aug 11, 2014 at 15:26

If you have a way of accurately identifying a troll you want him to stop engaging with your website. You have a bunch of options of doing so.

You can increase page loading time. When your website becomes sluggish trolling becomes less fun. Randomly ignoring 10% of the mouse clicks of the user would have a similar effect.

When it comes to user submitted content you can pretend to the troll that he successfully submitted content but hide the content from all other users.

  • Of course, only if you can be absolutely sure that it's a troll! Aug 11, 2014 at 14:16

You might also consider this from a security point of view. One or two actions like this from any one person can be a mistake. Repeated attempts are an attack. While I wouldn't take actions that would purposely egg them on ("dude, you'll have to try harder than that to submit a comment!") if you can nail down invalid application requests from one person/source, then lock them out. That's simple to say of course. The details are harder: how long are they locked out, do all invalid actions count the same as others, etc.

See the Mozilla AppSensor project for more info on this approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.