Wikipedia:Cleaning up vandalism manually

This article gives advice on how to clean up vandalism manually through the recent changes feed, also known as the "old school" way of cleaning up vandalism. Sometimes you need to do so when Huggle or STiki fails, or you have problems installing them, or any other reason. There are several things to check for, such as change in page size, edit summary, and tags. Do NOT check every change. Due to the high volume of edits per minute, checking every diff link will waste a lot of time, and you won't have time to check them all before new entries come in. Choose suspicious entries to patrol, which will be covered in the following sections.

A recent changes entry looks something like this:
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Added citations to unsourced info)

Change in page size
This is an important thing to check for, since blanking will be easily spotted in it. Note that the "-10,000" is in bold, making it easier to spot. This large change in page size indicates blanking, so go ahead and hit "undo" right away. If you have rollback you can use it, since it appears right next to the entry.
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Added content)

There are also tags and automatic edit summaries when a user blanks a page (and does not leave an edit summary for the latter)

If there is a large addition to the page, it is also worth checking out. These vandals might have added a whole chunk of Lorem ipsum to the page, sometimes to make it load very slow, or to overload the servers, although that is unlikely.
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Added content)

Edit summary
Vandals will often use the following edit summaries to hide their wrongdoings: Look how the vandal tries to blend in with the other edits. (But sorry vandals, this actually makes you more visible.) The edit seems legitimate by its entry in the recent changes, but is actually vandalism.
 * Added content
 * Added
 * Fixed typo
 * Typo
 * Fixed grammar
 * Grammar
 * I made it better
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Fixed typo)

Automatic edit summaries
There are also automatic edit summaries that the MediaWiki software uses when a user blanks, creates, or redirects a page. Just revert them without even looking at all. Unambiguous vandalism.
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (← Blanked the page)
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (← Replaced content with 'Get a life losers wikipedia sucks')

Tags
Tags are good indicators of vandalism, and it is a good idea to check the tags on an edit.

Mobile edit
A large portion of vandalism comes from mobile edits. They are often followed with the "mobile web edit" or "mobile app edit" tag.
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Fixed typo) (Tags: Mobile edit, Mobile web edit) 
 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Fixed typo) (Tags: Mobile edit, Mobile app edit) 

Obvious tags

 * (diff | hist) . . Foobar; 12:00 . . . . Example (talk | contribs) (Fixed typo) (Tags: Mobile edit, Mobile web edit, possible BLP issue or vandalism, section blanking, repeating characters, nonsense characters, shouting, canned edit summary) 

A list of obvious tags include: Check them immediately, although ClueBot NG may have reverted it before you can even load the page, due to how obvious that type of vandalism is. (It's always nice to beat that bot to vandalism.)
 * possible BLP issue or vandalism
 * possible vandalism
 * section blanking
 * blanking
 * repeating characters
 * nonsense characters
 * shouting
 * canned edit summary

Repetitive vandalism from same user
It is always a good idea to check the user's contributions periodically if you spot existing user warnings added recently on their talk page. These vandals are likely to repeat their actions so monitor their contributions. If you have Twinkle (see below), sometimes you can revert their edits directly without checking the diff links, although it is always good to check for good-faith edits.

Commonly vandalized articles
Some articles receive a high level of vandalism due to their topic, such as:
 * recent events
 * human reproduction
 * race and ethnicity
 * discrimination
 * articles about profanity
 * BLPs of famous singers, actors, music producers
 * popular films, TV series, etc.

Hide registered users
Although most edits come from anonymous IPs, most vandalism also comes from them. Hiding edits from registered users can actually reduce the rate that you need to refresh the page, considering the high number of edits per second, although you cannot catch vandals with accounts. For registered vandals, just let the sysops deal with them.

Warnings and reporting
As usual, warn the user. There are shortcuts to uw-vandalism templates, such as instead of typing in the entire template name. It is a good idea to use Twinkle to warn the user too.

Report after the vandal does something bad after a level 4 or 4im warning (often denoted with a stop hand sign ) as usual. Use shortcut WP:AIV to get there quickly without having to type in the whole thing.

Twinkle and rollback
These tools actually allow you to revert all edits of a single user, and you don't have to go through the undo button and the confirmation screen. Get Twinkle right after you're autoconfirmed, it makes your life easier. Rollback allows you to use Huggle, STiki and some other tools.

How rollback looks like:
 * (diff | hist) . . Foobar; 12:00 . . . . UBX (Talk | contribs) (Added content) [ rollback ]